CVE-2026-80574

A flaw was found in the Linux kernel's focaltech input driver. This vulnerability occurs in the focaltech_process_rel_packet function, where incorrect handling of input can lead to an array out-of-bounds write. This memory corruption issue could potentially allow an attacker to cause system instability or execute arbitrary code.

A moderate out-of-bounds write flaw was found in the Linux kernel's FocalTech touchpad driver as shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and in Red Hat In-Vehicle Operating System (RHIVOS) 2.0 and 2.1 (kernel, kernel-rt, and kernel-ivos-qualcomm). In focaltech_process_rel_packet(), when a finger index of 0 is read from a device packet and decremented, the signed result (-1) bypasses the existing FOC_MAX_FINGERS bounds check and writes to state->fingers[-1], corrupting kernel memory immediately before the array. A local attacker able to submit crafted input on a system with an affected FocalTech touchpad device could use this flaw to corrupt kernel memory, most realistically causing a kernel panic and denial of service. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those kernel versions. The fix for affected releases is deferred to a future regularly scheduled kernel update; the residual risk is limited to local availability impact, or targeted memory corruption, on systems that use the affected FocalTech driver, since exploitation requires both local access and such hardware. The Red Hat severity of moderate (CVSS 5.5) differs from the upstream CVEORG rating of important (CVSS 8.4) because the Red Hat assessment reflects the local attack vector and the constrained nature of the write, whose primary impact is on availability rather than broad confidentiality and integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.