CVE-2026-80574 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel contains a critical integer underflow vulnerability within the focaltech touchscreen driver, specifically in the function responsible for processing relative packet data. This flaw arises from improper handling of finger index values during touch event interpretation. The core issue is that variables tracking finger identifiers, such as finger2 and finger1, were defined with signed integer types rather than unsigned integers. When a valid input value of zero is processed, arithmetic operations involving these indices can result in negative numbers due to standard two's complement representation rules for signed integers.
In the specific context of focaltech_process_rel_packet, subtracting one from an index that equals zero results in -1 when stored in a signed integer variable. This negative value then serves as an array offset into the state->fingers structure. Because C language arrays are indexed using unsigned offsets or because the subsequent bounds check fails to correctly interpret the negative number as out-of-bounds, the kernel proceeds to write data at memory location fingers[-1]. This effectively writes one element before the start of the allocated array buffer, leading to a heap-based buffer overflow that corrupts adjacent memory structures.
The operational impact of this vulnerability is severe, potentially allowing for arbitrary code execution or system instability. An attacker who can control the input sent to the touchscreen driver, such as through physical access to the device or via compromised hardware interfaces, could exploit this out-of-bounds write to overwrite critical kernel data structures. This may lead to privilege escalation, denial of service conditions caused by memory corruption, or information disclosure depending on what adjacent memory contents are modified and how they are subsequently accessed by other parts of the operating system.
This vulnerability aligns with CWE-193 Off-by-One Error and CWE-787 Out-of-bounds Write in the Common Weakness Enumeration database. From a tactical perspective, it represents an exploitation vector for local privilege escalation or denial of service, mapping to ATT&CK techniques related to memory corruption and kernel-level abuse. The root cause is fundamentally a type safety issue where signed integers are used in contexts requiring strict unsigned arithmetic semantics to prevent negative index generation during subtraction operations.
Mitigation requires updating the data types of finger1 and finger2 within the focaltech driver source code from signed integer types to unsigned integer types. This change ensures that subtracting one from zero results in a large positive value due to modular arithmetic, which will then correctly trigger existing bounds checks against FOC_MAX_FINGERS rather than bypassing them. Developers must also review similar patterns throughout the kernel input subsystem to ensure consistent use of appropriate numeric types for array indexing operations. Applying this patch and keeping systems updated with the latest stable kernel releases is essential to prevent exploitation of this memory corruption flaw.