CVE-2026-19576

Name of the Vulnerable Software and Affected Versions Goodix GT9xx input driver (affected versions not specified)

Description The Goodix GT9xx input driver contains a flaw in the gt911 process() function within drivers/input/input gt911.c. The driver reads a touch point count from the controller's status register and uses this value as a loop bound to fill the point reg[] stack array without sufficient validation. Because the array size is limited by CONFIG INPUT GT911 MAX TOUCH POINTS (ranging from 1 to 5), a controller reporting up to 15 points can cause an out-of-bounds stack write of up to 112 bytes. This can lead to kernel-level control-flow hijacking on the host MCU, as well as out-of-bounds reads and system crashes. The issue can be triggered by a spoofed I2C touch controller, certain GT9271-class panels, or bus corruption. Exploitation requires physical or local hardware access.

Recommendations Apply the fix that implements a min() check to clamp the reported touch point count against CONFIG INPUT GT911 MAX TOUCH POINTS before any array indexing occurs.