CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: goodix - clamp the device-reported contact count<br /> <br /> goodix_ts_read_input_report() copies the number of touch points reported<br /> by the device into an on-stack buffer<br /> <br /> u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];<br /> <br /> which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only<br /> runtime check bounds the per-interrupt count against ts-&gt;max_touch_num,<br /> but that value is taken verbatim from a 4-bit field of the device<br /> configuration block and is never clamped:<br /> <br /> ts-&gt;max_touch_num = ts-&gt;config[MAX_CONTACTS_LOC] &amp; 0x0f;<br /> <br /> The nibble can be 0..15, so a malfunctioning, malicious or counterfeit<br /> controller (or an attacker tampering with the I2C bus) can advertise up<br /> to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num<br /> of up to 15 and the second goodix_i2c_read() writes<br /> ts-&gt;contact_size * (touch_num - 1) bytes past the one-contact header into<br /> point_data - up to 30 bytes (45 with the 9-byte report format) beyond the<br /> 92-byte buffer: a stack out-of-bounds write.<br /> <br /> Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts<br /> point_data[] is sized for, when reading it from the configuration.