CVE-2026-64274
Received Received - Intake

Buffer Overflow in Goodix Linux Kernel Touchscreen Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodix_ts_read_input_report() copies the number of touch points reported by the device into an on-stack buffer u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS]; which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only runtime check bounds the per-interrupt count against ts->max_touch_num, but that value is taken verbatim from a 4-bit field of the device configuration block and is never clamped: ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f; The nibble can be 0..15, so a malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can advertise up to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num of up to 15 and the second goodix_i2c_read() writes ts->contact_size * (touch_num - 1) bytes past the one-contact header into point_data - up to 30 bytes (45 with the 9-byte report format) beyond the 92-byte buffer: a stack out-of-bounds write. Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts point_data[] is sized for, when reading it from the configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64274
EUVD
EUVD-2026-48986

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
goodix goodix_ts *-*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the Linux kernel's Goodix touchscreen driver. It occurs when the driver reads the number of touch contacts reported by a device. The driver fails to properly validate this number, allowing a malicious device to report up to 15 contacts instead of the expected maximum of 10. This causes the driver to write beyond the allocated buffer on the stack, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's goodix touchscreen driver and cannot be detected via network scans or general system commands. Check kernel logs for goodix-related errors or crashes, particularly during touchscreen initialization or input handling. Look for messages indicating out-of-bounds writes or buffer overflows in the goodix driver.

Impact Analysis

This vulnerability could allow an attacker with physical access to a device or control over the I2C bus to trigger a kernel crash or execute arbitrary code with kernel privileges. This could lead to system instability, denial of service, or unauthorized access to sensitive data on affected systems using the Goodix touchscreen driver.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. If you are using a custom or vendor kernel, contact the vendor for an updated kernel package. Avoid using untrusted or counterfeit touchscreen controllers that may exploit this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart