CVE-2026-80566 Overview
CVE-2026-80566 affects the Linux kernel's hynitron_cstxxx touchscreen input driver. The driver fails to validate touch count and finger ID values received from the controller before using them to index a fixed-size report buffer and input slot array. An out-of-range finger ID equal to max_touch_num reaches cst3xx_report_contact(), corrupting the touch state of the previously active slot. Similarly, an unchecked touch count read from the controller is used to index the fixed-size report buffer.
Critical Impact
Malformed or malicious touch reports from the controller can corrupt touch state and cause the driver to parse data beyond the report buffer's bounds, resulting in kernel input subsystem instability on affected devices such as the V821 Avaota F1 board.
Affected Products
- Linux kernel builds including the hynitron_cstxxx touchscreen driver
- Devices using Hynitron CST3xx-series touch controllers
- V821 Avaota F1 board (explicitly referenced in the fix commit)
Discovery Timeline
- 2026-08-26 - CVE-2026-80566 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80566
Vulnerability Analysis
The hynitron_cstxxx driver allocates max_touch_num input slots, indexed from zero through max_touch_num - 1. Two related validation gaps exist in the touch reporting path.
First, the driver reads a touch count from the controller's report and uses it directly to index a fixed-size report buffer. The count is not bounds-checked against the supported number of touch slots before the driver parses touch data or examines the trailing byte of the buffer.
Second, the finger ID validation is off-by-one. The existing check permits a finger ID equal to max_touch_num to reach cst3xx_report_contact(). The Linux input core silently ignores out-of-range slot indices, but the driver still emits contact reports. This causes the previously active slot's state to be corrupted because no valid slot change was signaled before the reports.
On the V821 Avaota F1 board, the vendor driver configures a single touch slot, so a finger ID of 1 is already invalid on that hardware.
Root Cause
The root cause is improper input validation [CWE-20] of untrusted data received from the touch controller over the hardware bus. Both the touch count and per-finger ID fields are trusted and used as array indices without prior bounds enforcement.
Attack Vector
The attack surface is limited to code paths that process touch controller reports. A malfunctioning, physically tampered, or maliciously firmware-modified touch controller can emit crafted reports that trigger the out-of-range access or slot state corruption. Local unprivileged users cannot directly reach this path without physical or bus-level access to the touch controller.
See the upstream fix in Kernel Git Commit 27f380e for the exact reporting-path changes.
Detection Methods for CVE-2026-80566
Indicators of Compromise
- Kernel log entries showing dropped or malformed touch frames from the hynitron_cstxxx driver.
- Erratic touch behavior on the V821 Avaota F1 or other CST3xx-based devices, including stuck contacts or phantom touches.
- Input subsystem warnings about slot indices exceeding the configured max_touch_num.
Detection Strategies
- Inventory Linux kernel versions across fleet devices and identify systems built with the hynitron_cstxxx driver enabled.
- Compare running kernel commit hashes against the fixed commits referenced in the kernel.org advisory to determine patch status.
- Monitor dmesg and journalctl -k output for repeated input driver warnings correlated with touchscreen activity.
Monitoring Recommendations
- Centralize kernel and input subsystem logs from embedded and IoT Linux devices for anomaly analysis.
- Alert on repeated malformed touch report events, which may indicate hardware fault or attempted controller tampering.
- Track kernel package versions in configuration management to detect drift from patched baselines.
How to Mitigate CVE-2026-80566
Immediate Actions Required
- Apply the upstream Linux kernel patch that rejects touch counts larger than max_touch_num and finger IDs greater than or equal to max_touch_num.
- Rebuild and redeploy kernels for embedded Linux devices using CST3xx-series touch controllers.
- Validate hardware supply chain integrity for touch controllers on affected boards such as the V821 Avaota F1.
Patch Information
The fix is available in multiple stable branches through the following commits: Kernel Git Commit 27f380e, Kernel Git Commit 387829e, Kernel Git Commit 38e7d5c, Kernel Git Commit 51c5503, and Kernel Git Commit ec61ca4. The patches add range checks so the driver rejects invalid counts before parsing and returns immediately when an invalid finger ID is encountered.
Workarounds
- Disable the hynitron_cstxxx driver in kernel configuration on devices that do not require Hynitron touch input.
- Restrict physical access to devices to reduce the risk of controller tampering.
- For fleets that cannot immediately upgrade, monitor kernel logs and replace touch controllers exhibiting malformed reports.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
