Executive brief
The FocalTech touchpad driver in the Linux kernel contains an array out-of-bounds vulnerability when processing relative motion packets. If a malicious or malformed packet is received with a finger index of 0, the driver writes to an invalid memory address instead of rejecting the packet. This could allow a local attacker with physical access to a FocalTech PS/2 touchpad to trigger memory corruption and potentially execute arbitrary code.
Technical details
The vulnerability is an integer signedness bug in the focaltech_process_rel_packet() function in drivers/input/mouse/focaltech.c. The finger1 and finger2 variables were declared as signed integers; when the packet-derived finger index is 0, subtracting 1 results in -1, which accesses state->fingers[-1] instead of triggering the FOC_MAX_FINGERS bounds check that the existing code comment indicates should occur. The fix changes finger1 and finger2 to unsigned int, so that subtracting 1 from 0 causes an unsigned integer underflow that exceeds FOC_MAX_FINGERS and is properly rejected. Attack requires physical access to send a crafted PS/2 packet. The fix is available in stable kernel releases and upstream.
Affected products
- Linux Linux kernel all versions with focaltech driver support (linux 3.x through 6.x and later)
Timeline
- 2026-08-26: disclosed: CVE-2026-80574 published on NVD
- 2026-08-23: patched: Fix merged into stable kernel trees (commit 063b4c6a6f3fc01bca085c442000c9c100fdbd93)
- 2026-08-02: other: Fix authored by Richard Davies