CVE-2026-64274

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack out-of-bounds write exists in the goodix ts read input report() function. The function copies the number of touch points reported by a device into an on-stack buffer point data, which is sized for a maximum of 10 contacts. However, the max touch num value is read from a 4-bit field of the device configuration block without being clamped, allowing it to reach up to 15. A malicious or malfunctioning controller, or an attacker tampering with the I2C bus, can advertise up to 15 contacts, causing the goodix i2c read() function to write up to 45 bytes beyond the buffer boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.