CVE-2026-64274: Input: goodix - clamp the device-reported contact count

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Input: goodix - clamp the device-reported contact count

goodix_ts_read_input_report() copies the number of touch points reported
by the device into an on-stack buffer

	u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];

which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only
runtime check bounds the per-interrupt count against ts->max_touch_num,
but that value is taken verbatim from a 4-bit field of the device
configuration block and is never clamped:

	ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;

The nibble can be 0..15, so a malfunctioning, malicious or counterfeit
controller (or an attacker tampering with the I2C bus) can advertise up
to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num
of up to 15 and the second goodix_i2c_read() writes
ts->contact_size * (touch_num - 1) bytes past the one-contact header into
point_data - up to 30 bytes (45 with the 9-byte report format) beyond the
92-byte buffer: a stack out-of-bounds write.

Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts
point_data[] is sized for, when reading it from the configuration.

The Linux kernel CVE team has assigned CVE-2026-64274 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 5.10.261 with commit e825f352ef5271255cd08cc994b0dc25648a2f38
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 5.15.212 with commit 4bfea9c3a0981c1c7fc5d1a1b27197b2de247902
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 6.1.178 with commit 98b2caef249183b572c04451365246f919707845
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 6.6.145 with commit 719d1a2c83a46be6bf81af905e4f6adb3d32dc28
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 6.12.96 with commit 46addbd13dbf4aacb71cfbca964a5e552d0f45ae
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 6.18.39 with commit 3b32303460155603d25444274856013d211d5e1f
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 7.1.4 with commit 2a67668690129953e898923260a2dd1c7c196495
	Issue introduced in 4.1 with commit a7ac7c95d4682883d141c5d7a7544d2818f0a09f and fixed in 7.2-rc1 with commit 5ed62a96e06be4e94b8296b7932afee550a70e04

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64274
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/input/touchscreen/goodix.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e825f352ef5271255cd08cc994b0dc25648a2f38
	https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902
	https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845
	https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28
	https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae
	https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f
	https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495
	https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04