EUVD-2026-66489
GHSA-qm8h-24xg-3v98
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector with high complexity (reliable kernel heap exploitation requires additional primitives beyond the write primitive); low privilege reflects unprivileged local user access to input device layer.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
AnalysisAI
Out-of-bounds kernel heap write in the Linux kernel's Focaltech touchpad input driver allows local attackers to corrupt kernel memory through a signed integer underflow in the finger index variable. The focaltech_process_rel_packet function incorrectly handles a packet reporting finger index 0: subtracting 1 from a signed variable produces -1 rather than wrapping to a large unsigned value, bypassing the FOC_MAX_FINGERS bounds check and writing to state->fingers[-1]. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running an unpatched Linux kernel version that contains the introducing commit `05be1d079ec0b3691783e4384b1ada82149ff7d2` (present since Linux 4.0) and lacks the branch-specific fix. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high severity, but real-world risk is substantially narrowed by the local attack vector and the hardware-specific trigger condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with physical access to a target laptop connects a USB HID device programmed to emulate a Focaltech touchpad and transmit a crafted relative-motion packet containing finger index 0. The unpatched kernel driver subtracts 1 from the signed index, producing -1, and writes attacker-influenced data to `state->fingers[-1]` - a kernel memory location preceding the allocated array. … |
| Remediation | Apply the upstream stable kernel patch for the branch in use: 5.10.266 via commit 063b4c6a6f3fc01bca085c442000c9c100fdbd93, 5.15.217 via 81b07470cb2937ceb74b00be88151582a322433b, 6.1.184 via 6f6d5fe29efdf5001bc146fc292e6592cace93eb, 6.6.153 via 296736076b3fd078742651c719555a488624023a, 6.12.105 via 1842e47126816e56d30c4f856f9854fd7831066c, 6.18.46 via bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f, 7.1.10 via 83c265bfc084d77e2171d4b67362150ab38c935b, and 7.2 via ca92c98b806839c108995b2bbff7061515bdfb53 - all available at https://git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kernel versions 4.0-7.2.x by executing 'uname -r' across the infrastructure and confirm Focaltech driver presence via 'lsmod | grep focaltech'. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today