CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved:

Input: goodix - clamp the device-reported contact count

goodix_ts_read_input_report() copies the number of touch points reported

by the device into an on-stack buffer

u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];

which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only

runtime check bounds the per-interrupt count against ts->max_touch_num,

but that value is taken verbatim from a 4-bit field of the device

configuration block and is never clamped:

ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;

The nibble can be 0..15, so a malfunctioning, malicious or counterfeit

controller (or an attacker tampering with the I2C bus) can advertise up

to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num

of up to 15 and the second goodix_i2c_read() writes

ts->contact_size * (touch_num - 1) bytes past the one-contact header into

point_data - up to 30 bytes (45 with the 9-byte report format) beyond the

92-byte buffer: a stack out-of-bounds write.

Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts

point_data[] is sized for, when reading it from the configuration.