Description

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-26T15:17:13.393Z",
  "pubdate": "2026-08-26T15:17:13.393Z",
  "executiveSummary": "This vulnerability is an array out-of-bounds write flaw located in the focaltech Linux kernel input driver, specifically within the focaltech_process_rel_packet function.\nThe issue stems from improper signed integer handling when processing finger index data, leading to an integer underflow condition.\nAn attacker capable of injecting malicious or malformed input packets via the Focaltech touchscreen hardware can trigger this condition, resulting in memory corruption.\nThe vulnerability allows for an out-of-bounds write to the state->fingers structure, writing to a negative offset relative to the base pointer.\nSuccessful exploitation could lead to kernel memory corruption, potentially resulting in system crashes (denial of service) or arbitrary code execution, depending on the attacker's ability to control the corrupted memory contents.\nThe vulnerability affects the Linux kernel input subsystem handling Focaltech touch controllers.",
  "technicalDetails": "The vulnerability exists in the focaltech_process_rel_packet function, which is responsible for parsing relative movement packets from Focaltech touchscreen hardware.\nThe root cause is a type mismatch involving the 'finger1' and 'finger2' variables. These variables, representing the index of the detected finger, were defined as signed integers. In the vulnerable code path, a finger index value of 0 was passed to the processing logic.\nWhen the logic performs the calculation 'finger - 1' on a signed integer with a value of 0, the result becomes -1. Because this result is used as an index for the 'state->fingers' array, the kernel performs an out-of-bounds write at 'state->fingers[-1]'.\nUnder normal operating conditions, the code is intended to validate the finger index against 'FOC_MAX_FINGERS'. However, by treating the index as a signed integer, the safety check is bypassed when the calculation results in a negative value, as the sign bit is interpreted differently in memory access operations.\nThe exploitation flow involves an attacker manipulating the communication channel between the Focaltech hardware and the kernel driver. By crafting a specific input packet that contains a finger index of 0, an attacker forces the driver to interpret the index calculation as -1, causing the pointer arithmetic to reference memory preceding the 'state->fingers' buffer.\nThe impact of this out-of-bounds write is severe. Writing to 'state->fingers[-1]' results in direct kernel memory corruption. Depending on the memory layout and the kernel build, the corrupted memory may contain sensitive kernel structures, function pointers, or data critical to kernel stability. Overwriting adjacent memory structures can lead to immediate kernel panic (DoS) or, if the attacker can influence the data written, potentially achieve control over the kernel's instruction pointer through object manipulation.\nNo authentication or specific privilege level is required beyond the ability to trigger the driver to process raw packets from the touchscreen device. This exposure is local to systems physically equipped with the vulnerable Focaltech hardware."
}