Linux Kernel EUVD-2026-66489

The target must be running an unpatched Linux kernel version that contains the introducing commit 05be1d079ec0b3691783e4384b1ada82149ff7d2 (present since Linux 4.0) and lacks the branch-specific fix. The focaltech_ts kernel module must be loaded, which occurs automatically only when a Focaltech-branded touchpad is detected on a supported bus (typically I2C or SPI in laptops); the module is absent on servers, VMs, and systems with non-Focaltech input hardware, making them immune regardless of kernel version. Triggering the bug requires delivering a relative packet with finger index 0 to the driver, which in practice means either physical attachment of a malicious HID device or local system access on a machine actively using Focaltech hardware. Systems running patched versions (5.10.266+, 5.15.217+, 6.1.184+, 6.6.153+, 6.12.105+, 6.18.46+, 7.1.10+, 7.2+) are not exploitable.

The provided CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high severity, but real-world risk is substantially narrowed by the local attack vector and the hardware-specific trigger condition. Exploitation requires that a Focaltech touchpad - real or emulated - deliver a crafted relative packet, which in practice means physical access to attach a malicious HID device or local system access on a machine with Focaltech hardware. The PR:N rating is defensible under the physical-device threat model (no OS credentials needed to connect hardware) but presupposes proximity to the target. No EPSS score was provided; the absence of a KEV listing and any known proof-of-concept depresses opportunistic exploitation risk considerably. The C:H/I:H/A:H impact triplet is theoretically accurate for a kernel out-of-bounds write - memory corruption at ring-0 can yield full system compromise - but reliable kernel heap exploitation typically demands supplementary primitives (KASLR bypass, heap feng shui), pushing practical complexity above what AC:L implies. Overall, unpatched laptop fleets equipped with Focaltech touchpads carry meaningful exposure; server deployments, cloud VMs, and systems with other touchpad hardware are not in scope, making this a patch-prioritized-in-next-cycle finding rather than an emergency response item.

An attacker with physical access to a target laptop connects a USB HID device programmed to emulate a Focaltech touchpad and transmit a crafted relative-motion packet containing finger index 0. The unpatched kernel driver subtracts 1 from the signed index, producing -1, and writes attacker-influenced data to state->fingers[-1] - a kernel memory location preceding the allocated array. By controlling heap layout and repeatedly triggering the corruption, the attacker may overwrite adjacent kernel structures to escalate privileges to root. No public proof-of-concept exploit is known at time of analysis.