CVE-2026-80566

A flaw was found in the hynitron_cstxxx driver in the Linux kernel. This vulnerability allows an attacker to provide specially crafted touch input that can bypass validation checks for touch count and finger identifiers (IDs). This improper handling can lead to the corruption of the touch state or the discarding of valid touch frames, effectively causing a denial of service for the touch input functionality.

A flaw was found in the hynitron_cstxxx touchscreen driver in the Linux kernel, which Red Hat Product Security rated as having Moderate impact. The driver failed to validate the touch count and finger identifiers reported by the touchscreen controller: a finger ID equal to max_touch_num could reach the contact-reporting path and corrupt the touch state of the previously active input slot, and an unvalidated touch count could be used to index the fixed-size report buffer without a range check. On systems using this driver, an attacker with the ability to supply specially crafted touch reports from the controller could exploit this flaw to corrupt touch state or cause valid touch frames to be discarded, resulting in a denial of service of the touch input functionality. Red Hat Product Security assigned a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt update streams are marked NOT AFFECTED for this flaw because the vulnerable code is not present in the shipped Red Hat kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.