HIGH Introduced in 4.0
focaltech FingerIndex OOB
CVE-2026-80574
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
02KernelScan AI Analysis
Risk summary
A physically proximate attacker can exploit an out-of-bounds write in the FocalTech touchpad driver by sending a crafted PS/2 input packet with a zero finger index. This can corrupt kernel memory, potentially causing a system crash or arbitrary code execution in kernel context. The vulnerability requires physical access to the device's touchpad interface and no user privileges.
Vulnerability analysis
The FocalTech PS/2 touchpad driver processes relative movement packets by extracting a finger index from the input data and subtracting one to use as an array offset. When the packet contains a finger index of zero, the subtraction underflows because the variable is signed, producing a negative index that bypasses the existing bounds check and writes to memory before the start of the finger state array. The fix changes the finger index variables to unsigned so that a zero index wraps to a large positive value, which is then correctly caught by the bounds check. The vulnerable code path is reached from the PS/2 input subsystem when a FocalTech touchpad sends a crafted packet, requiring physical access to the touchpad hardware interface but no system privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.0 | 5.10.266 | 063b4c6a6f3f |
| 5.15 | 4.0 | 5.15.217 | bb502d79acb9 |
| 6.1 | 4.0 | 6.1.184 | ca92c98b8068 |
| 6.6 | 4.0 | 6.6.153 | 81b07470cb29 |
| 6.12 | 4.0 | 6.12.105 | 6f6d5fe29efd |
| 7.1 | 4.0 | 7.1.10 | 1842e4712681 |
| mainline | 4.0 | 7.2 | 296736076b3f |
| 6.18 | 4.0 | 6.18.46 | 83c265bfc084 |
| cip/4.19 | 4.0 | 4.19.325-cip136 | a257db028ce0 |
| cip/4.19-rt | 4.0 | 4.19.325-cip136-rt50 | a257db028ce0 |
| cip/4.4 | 4.0 | 4.4.302-cip115 | 0c4c76c56bb9 |
| cip/4.4-rt | 4.0 | 4.4.302-cip115-rt63 | 0c4c76c56bb9 |
| cip/5.10 | 4.0 | 5.10.268-cip77 | 063b4c6a6f3f |
| cip/5.10-rt | 4.0 | 5.10.268-cip77-rt34 | 063b4c6a6f3f |
| cip/6.1 | 4.0 | 6.1.187-cip60 | ca92c98b8068 |
| cip/6.12 | 4.0 | 6.12.108-cip31 | 6f6d5fe29efd |