Stack Overflow Vulnerability in Goodix GT9xx Touch Drivers

CVE-2026-19576

What is CVE-2026-19576?

The Goodix GT9xx input driver contains a serious vulnerability that allows for out-of-bounds stack writes due to improper handling of touch point counts. The driver reads touch point counts from the controller's status register and uses this count without adequately validating it against the configured maximum. If a malicious or faulty I2C touch controller reports more touch points than the driver's internal array can handle, it leads to potential stack overflow, enabling attackers to execute arbitrary code with kernel-level permissions. This vulnerability necessitates local hardware access to exploit, as remote attacks are not feasible. The driver fix ensures compliance by constraining reported touch counts to the maximum specified during configuration.

References