CVE-2026-80574

HighCVSS 8.4/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < 063b4c6a6f3fc01bca085c442000c9c100fdbd93; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < ca92c98b806839c108995b2bbff7061515bdfb53; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < 81b07470cb2937ceb74b00be88151582a322433b; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < 6f6d5fe29efdf5001bc146fc292e6592cace93eb; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < 83c265bfc084d77e2171d4b67362150ab38c935b; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < 1842e47126816e56d30c4f856f9854fd7831066c; >= 05be1d079ec0b3691783e4384b1ada82149ff7d2, < 296736076b3fd078742651c719555a488624023a
LinuxLinux4.0

References

Timeline

Published
Aug 26, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-805757.8In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_adCVE-2026-805768.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX riCVE-2026-80577In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthor_fw_load_sectionCVE-2026-805787.3In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_reCVE-2026-805797.8In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() caCVE-2026-80584.9IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stoCVE-2026-805807.8In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses CVE-2026-80581In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeoCVE-2026-805827.8In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_CVE-2026-805837.8In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODCVE-2026-805848.4In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeCVE-2026-805859.4In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fa