CVE-2026-64274

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: goodix - clamp the device-reported contact count

goodix_ts_read_input_report() copies the number of touch points reported

by the device into an on-stack buffer

u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];

which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only

runtime check bounds the per-interrupt count against ts->max_touch_num,

but that value is taken verbatim from a 4-bit field of the device

configuration block and is never clamped:

ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;

The nibble can be 0..15, so a malfunctioning, malicious or counterfeit

controller (or an attacker tampering with the I2C bus) can advertise up

to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num

of up to 15 and the second goodix_i2c_read() writes

ts->contact_size * (touch_num - 1) bytes past the one-contact header into

point_data - up to 30 bytes (45 with the 9-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References