CVE-2026-80574: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80574 Overview

CVE-2026-80574 is an out-of-bounds write vulnerability in the Linux kernel's focaltech touchpad input driver. The flaw resides in the focaltech_process_rel_packet function, where the finger1 and finger2 variables are declared as signed integers. When a crafted input packet supplies a finger index of 0, the driver subtracts 1 from that value, producing -1. The existing bounds check against FOC_MAX_FINGERS fails to catch the negative index, allowing the code to write to state->fingers[-1] and corrupt adjacent kernel memory.

Critical Impact
A local attacker with the ability to deliver malicious touchpad packets can trigger kernel memory corruption, enabling potential privilege escalation or denial of service.

Affected Products

Linux kernel branches containing the focaltech PS/2 touchpad driver prior to the fix commits
Distributions shipping the vulnerable drivers/input/mouse/focaltech.c code path
Systems using Focaltech touchpad hardware exposing the relative-packet processing logic

Discovery Timeline

2026-08-26 - CVE-2026-80574 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80574

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the focaltech_process_rel_packet function of the Linux kernel input subsystem. The function parses relative-motion packets from Focaltech touchpads and dispatches per-finger state updates into the state->fingers[] array.

The original implementation stored the finger index in signed variables (finger1 and finger2) and subtracted 1 to convert the 1-based hardware index into a 0-based array index. When the hardware supplies a finger index of 0, the subtraction yields -1. A subsequent comparison against FOC_MAX_FINGERS treats the signed -1 as a valid, in-range value, letting execution proceed with a negative index.

The upstream fix changes finger1 and finger2 to unsigned types. Unsigned subtraction of 0 - 1 wraps to a large positive value that clearly exceeds FOC_MAX_FINGERS, causing the bounds check to reject the packet as the original code comment intended.

Root Cause

The root cause is improper handling of signed integer arithmetic in a boundary check. The developer intended the bounds check to catch invalid indices, but signed-integer semantics allowed a negative index to bypass the comparison.

Attack Vector

Exploitation requires local access to a system with a Focaltech touchpad or the ability to inject crafted PS/2 packets into the input stack. The attacker delivers a malformed packet with a finger index of 0, triggering the write to state->fingers[-1] and corrupting kernel memory adjacent to the fingers array within the driver's state structure.

See the upstream kernel commits referenced below for the exact patch diff.
No public proof-of-concept exploit code is available for CVE-2026-80574.

Detection Methods for CVE-2026-80574

Indicators of Compromise

Unexpected kernel oops or panic messages referencing focaltech_process_rel_packet or drivers/input/mouse/focaltech.c
KASAN reports flagging out-of-bounds writes in the focaltech driver state structure
Anomalous behavior on systems with Focaltech touchpad hardware following unprivileged user activity

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to catch out-of-bounds writes in the input subsystem
Audit installed kernel package versions against the fixed commits listed in the kernel.org stable tree
Monitor dmesg and journald for input driver stack traces that reference the focaltech module

Monitoring Recommendations

Collect kernel crash dumps and forward them to a centralized logging system for correlation
Track loaded kernel modules on endpoints and alert on unexpected reloads of focaltech
Correlate local-user session activity with kernel error events to identify potential exploitation attempts

How to Mitigate CVE-2026-80574

Immediate Actions Required

Apply the vendor-supplied kernel update that incorporates the upstream focaltech fix
Inventory endpoints with Focaltech touchpad hardware and prioritize them for patching
Restrict local access to affected systems until the patched kernel is deployed

Patch Information

The fix has been merged into the mainline and multiple stable Linux kernel branches. Refer to the following upstream commits for the corrective change to drivers/input/mouse/focaltech.c: Kernel Git Commit 063b4c6, Kernel Git Commit 1842e47, Kernel Git Commit 2967360, Kernel Git Commit 6f6d5fe, Kernel Git Commit 81b0747, Kernel Git Commit 83c265b, Kernel Git Commit bb502d7, and Kernel Git Commit ca92c98. Distribution-specific patched packages should be tracked through each vendor's security advisory channel.

Workarounds

Blacklist the focaltech kernel module on systems where the touchpad is not required until patches are applied
Enforce physical and logical access controls to reduce the pool of users able to trigger local input driver code paths
Where feasible, disable PS/2 device probing on servers and virtual machines that have no legitimate need for touchpad input

bash

# Temporarily prevent the focaltech module from loading
echo "blacklist focaltech" | sudo tee /etc/modprobe.d/blacklist-focaltech.conf
sudo update-initramfs -u
sudo reboot