Linux Kernel Vulnerability in Touch Input Handling for Hynitron Devices

CVE-2026-80566

What is CVE-2026-80566?

The vulnerability in the Linux kernel affects the way touch input is handled in Hynitron's CSTXXX driver. Specifically, the driver allows an invalid finger ID, equal to or greater than the maximum number of touch slots, to pass through to the touch reporting function. This leads to potential corruption of the touch state for active slots as the input core is unable to manage out-of-range slot indices effectively. To mitigate this issue, it is essential to validate touch counts and reject any that exceed supported limits. The fix includes immediate returns upon encountering invalid finger IDs, ensuring that corrupt touch frames are discarded before any partial contact state is reported.

References