CVE-2026-64274

In the Linux kernel, the following vulnerability has been resolved:

Input: goodix - clamp the device-reported contact count

goodixtsreadinputreport() copies the number of touch points reported by the device into an on-stack buffer

u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];

which is sized for at most GOODIXMAXCONTACTS (10) contacts. The only runtime check bounds the per-interrupt count against ts->maxtouchnum, but that value is taken verbatim from a 4-bit field of the device configuration block and is never clamped:

ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;

The nibble can be 0..15, so a malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can advertise up to 15 contacts. goodixtsreadinputreport() then accepts a touchnum of up to 15 and the second goodixi2cread() writes ts->contactsize * (touchnum - 1) bytes past the one-contact header into pointdata - up to 30 bytes (45 with the 9-byte report format) beyond the 92-byte buffer: a stack out-of-bounds write.

Clamp maxtouchnum to GOODIXMAXCONTACTS, the number of contacts point_data[] is sized for, when reading it from the configuration.