Executive brief
The Linux kernel's Hynitron touchscreen driver did not properly validate touch count and finger ID values reported by the device hardware. An attacker with the ability to manipulate touchscreen input data (such as through a compromised or malicious device) could cause the driver to report corrupted touch state, leading to incorrect input event handling and potential denial of service or input spoofing on affected systems.
Technical details
The hynitron_cstxxx touchscreen driver allocates input slots indexed from 0 to max_touch_num - 1, but previously accepted finger IDs up to max_touch_num, allowing out-of-range slot indices to be processed. Additionally, the touch count read directly from the device's report buffer was not validated before use. The fix adds range checks to reject touch counts exceeding max_touch_num and finger IDs greater than or equal to max_touch_num, returning immediately when invalid data is detected. This prevents corrupt touch frames from being partially processed, which would otherwise corrupt the input state of previously active slots. The vulnerability requires physical access or a compromised touchscreen device to exploit.
Affected products
- Linux Linux kernel from introduction of hynitron_cstxxx driver (commit 66603243f528) through patch date (2026-08-03)
Timeline
- 2026-08-03: other: Fix committed to Linux kernel
- 2026-08-26: disclosed: Published as CVE-2026-80566