CVE-2026-64274: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64274 Overview

CVE-2026-64274 is a stack out-of-bounds write vulnerability in the Linux kernel goodix touchscreen input driver. The flaw resides in goodix_ts_read_input_report(), which trusts a device-reported contact count without clamping it against the driver's compiled-in maximum. A malfunctioning, malicious, or counterfeit Goodix controller, or an attacker tampering with the I2C bus, can advertise up to 15 contacts. The subsequent goodix_i2c_read() writes up to 30 bytes (45 with the 9-byte report format) past the 92-byte on-stack point_data[] buffer.

Critical Impact
A compromised or counterfeit I2C touchscreen controller can trigger a kernel stack buffer overflow, enabling denial of service or potential local privilege escalation on affected Linux systems.

Affected Products

Linux kernel drivers/input/touchscreen/goodix.c (Goodix touchscreen driver)
Linux distributions shipping the vulnerable goodix driver prior to the fix commits
Devices using Goodix I2C touchscreen controllers (laptops, tablets, embedded systems)

Discovery Timeline

2026-07-25 - CVE-2026-64274 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64274

Vulnerability Analysis

The goodix_ts_read_input_report() function reads touch events from a Goodix I2C touchscreen controller into a fixed-size on-stack buffer: u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS]. The buffer is sized for a hard maximum of GOODIX_MAX_CONTACTS (10) contacts. The driver's runtime check compares the per-interrupt touch_num against ts->max_touch_num, but that ceiling is derived from an untrusted device field. The bug allows writes past the end of a kernel stack buffer, corrupting adjacent stack data including return addresses and stack canaries.

Root Cause

The root cause is missing input validation on device-supplied configuration data. During probe, the driver reads ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f; directly from the controller's configuration block. Because the field is a 4-bit nibble, it can legally hold values 0 through 15, exceeding the compile-time GOODIX_MAX_CONTACTS limit of 10. No clamping is performed before the value is used as a loop and read-size bound.

Attack Vector

An attacker who controls the Goodix controller firmware, substitutes a counterfeit controller, or gains physical access to the I2C bus can advertise max_touch_num = 15. When touch events arrive, goodix_ts_read_input_report() accepts up to 15 contacts and issues a second goodix_i2c_read() that writes ts->contact_size * (touch_num - 1) bytes past the one-contact header. With the 8-byte contact format, this overflows the 92-byte buffer by up to 30 bytes; with the 9-byte format, by up to 45 bytes. The resulting kernel stack corruption can cause a panic or, with additional primitives, kernel code execution.

See the upstream fix in the Linux Kernel Commit 98b2caf and companion stable backports for exact patch semantics.

Detection Methods for CVE-2026-64274

Indicators of Compromise

Kernel oops or panic messages referencing goodix_ts_read_input_report or stack corruption in the Goodix driver.
Stack protector failures (Kernel stack is corrupted) logged around Goodix interrupt handling.
Unexpected i2c-goodix device resets, reprobes, or configuration reads on systems using Goodix touchscreens.

Detection Strategies

Inventory Linux endpoints for the presence and version of the goodix touchscreen driver using modinfo goodix and compare against patched kernel versions.
Monitor dmesg and journal logs for kernel warnings, oops, or panics originating in drivers/input/touchscreen/goodix.c.
Correlate hardware supply chain events (device replacement, dock connections) with subsequent kernel instability on touchscreen-equipped devices.

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on stack canary violations or Goodix-related crashes.
Track kernel package versions across the fleet and flag hosts still running unpatched kernels affected by CVE-2026-64274.
Baseline expected I2C touchscreen configuration values and alert on anomalous max_touch_num reads if instrumentation is available.

How to Mitigate CVE-2026-64274

Immediate Actions Required

Apply the vendor kernel update for your Linux distribution that includes the Goodix max_touch_num clamp fix.
Prioritize patching endpoints, tablets, and embedded devices known to ship with Goodix I2C touchscreens.
Restrict physical access to systems where an attacker could tamper with the I2C bus or swap the controller.

Patch Information

The fix clamps max_touch_num to GOODIX_MAX_CONTACTS when reading it from the device configuration, ensuring the value cannot exceed the size of point_data[]. Upstream and stable-tree patches are available in the following commits: Linux Kernel Commit 98b2caf, Linux Kernel Commit 2a67668, Linux Kernel Commit 3b32303, Linux Kernel Commit 46addbd, Linux Kernel Commit 4bfea9c, Linux Kernel Commit 5ed62a9, Linux Kernel Commit 719d1a2, and Linux Kernel Commit e825f35.

Workarounds

If patching is delayed and the Goodix touchscreen is not required, blacklist the module with blacklist goodix in /etc/modprobe.d/ and rebuild the initramfs.
Enforce hardware supply chain controls to prevent introduction of counterfeit or tampered Goodix controllers.
Ensure kernel stack protector (CONFIG_STACKPROTECTOR_STRONG) is enabled to convert exploitation attempts into detectable panics rather than silent compromise.

bash

# Verify kernel version and Goodix module status
uname -r
modinfo goodix | grep -E 'filename|version|srcversion'

# Optional: blacklist the driver until patched kernel is deployed
echo 'blacklist goodix' | sudo tee /etc/modprobe.d/blacklist-goodix.conf
sudo update-initramfs -u