CVE-2026-80566 (GCVE-0-2026-80566)
Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
EPSS
VEX
Title
Input: hynitron_cstxxx - validate touch count and finger IDs
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: hynitron_cstxxx - validate touch count and finger IDs
The driver allocates max_touch_num input slots, which are indexed from
zero through max_touch_num - 1. The current check allows a finger ID
equal to max_touch_num to reach cst3xx_report_contact(). While the input
core ignores out-of-range slot indices, reporting touch data without a
valid slot change corrupts the touch state of the previously active slot.
The touch count is read from the controller's report and is used to
index the fixed-size report buffer without first checking its range.
Reject counts larger than the supported number of touch slots before
checking the trailing byte or parsing touch data.
Reject finger IDs equal to or greater than max_touch_num, and return
immediately when an invalid finger ID is encountered so that corrupt
touch frames are discarded instead of reporting partial contact state.
The V821 Avaota F1 board configures the vendor driver with one touch
slot, so finger ID 1 is already invalid on that device.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
66603243f5283f7f28c795f09e7c2167233df0bd , < ec61ca4e310665816a639cb2e46cd9b3af0a9bee
(git)
Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 387829ee60de26c7c073ed4e27ecfab2b75d4c74 (git) Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 38e7d5c1ade04b99c70da0298ca296ee62bc99c0 (git) Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 51c5503554c87e4de4035468bebf186205391ce9 (git) Affected: 66603243f5283f7f28c795f09e7c2167233df0bd , < 27f380ef0e1d3de3cde114e02d33f9320ce3a5a6 (git) |
guessed | |
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/hynitron_cstxxx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ec61ca4e310665816a639cb2e46cd9b3af0a9bee",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "387829ee60de26c7c073ed4e27ecfab2b75d4c74",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "38e7d5c1ade04b99c70da0298ca296ee62bc99c0",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "51c5503554c87e4de4035468bebf186205391ce9",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
},
{
"lessThan": "27f380ef0e1d3de3cde114e02d33f9320ce3a5a6",
"status": "affected",
"version": "66603243f5283f7f28c795f09e7c2167233df0bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/hynitron_cstxxx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: hynitron_cstxxx - validate touch count and finger IDs\n\nThe driver allocates max_touch_num input slots, which are indexed from\nzero through max_touch_num - 1. The current check allows a finger ID\nequal to max_touch_num to reach cst3xx_report_contact(). While the input\ncore ignores out-of-range slot indices, reporting touch data without a\nvalid slot change corrupts the touch state of the previously active slot.\n\nThe touch count is read from the controller\u0027s report and is used to\nindex the fixed-size report buffer without first checking its range.\nReject counts larger than the supported number of touch slots before\nchecking the trailing byte or parsing touch data.\n\nReject finger IDs equal to or greater than max_touch_num, and return\nimmediately when an invalid finger ID is encountered so that corrupt\ntouch frames are discarded instead of reporting partial contact state.\n\nThe V821 Avaota F1 board configures the vendor driver with one touch\nslot, so finger ID 1 is already invalid on that device."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:29.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ec61ca4e310665816a639cb2e46cd9b3af0a9bee"
},
{
"url": "https://git.kernel.org/stable/c/387829ee60de26c7c073ed4e27ecfab2b75d4c74"
},
{
"url": "https://git.kernel.org/stable/c/38e7d5c1ade04b99c70da0298ca296ee62bc99c0"
},
{
"url": "https://git.kernel.org/stable/c/51c5503554c87e4de4035468bebf186205391ce9"
},
{
"url": "https://git.kernel.org/stable/c/27f380ef0e1d3de3cde114e02d33f9320ce3a5a6"
}
],
"title": "Input: hynitron_cstxxx - validate touch count and finger IDs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80566",
"datePublished": "2026-08-26T14:37:29.552Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-26T14:37:29.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80566\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:11.727\",\"lastModified\":\"2026-08-26T15:17:11.727\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: hynitron_cstxxx - validate touch count and finger IDs\\n\\nThe driver allocates max_touch_num input slots, which are indexed from\\nzero through max_touch_num - 1. The current check allows a finger ID\\nequal to max_touch_num to reach cst3xx_report_contact(). While the input\\ncore ignores out-of-range slot indices, reporting touch data without a\\nvalid slot change corrupts the touch state of the previously active slot.\\n\\nThe touch count is read from the controller\u0027s report and is used to\\nindex the fixed-size report buffer without first checking its range.\\nReject counts larger than the supported number of touch slots before\\nchecking the trailing byte or parsing touch data.\\n\\nReject finger IDs equal to or greater than max_touch_num, and return\\nimmediately when an invalid finger ID is encountered so that corrupt\\ntouch frames are discarded instead of reporting partial contact state.\\n\\nThe V821 Avaota F1 board configures the vendor driver with one touch\\nslot, so finger ID 1 is already invalid on that device.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/touchscreen/hynitron_cstxxx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"66603243f5283f7f28c795f09e7c2167233df0bd\",\"lessThan\":\"ec61ca4e310665816a639cb2e46cd9b3af0a9bee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66603243f5283f7f28c795f09e7c2167233df0bd\",\"lessThan\":\"387829ee60de26c7c073ed4e27ecfab2b75d4c74\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66603243f5283f7f28c795f09e7c2167233df0bd\",\"lessThan\":\"38e7d5c1ade04b99c70da0298ca296ee62bc99c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66603243f5283f7f28c795f09e7c2167233df0bd\",\"lessThan\":\"51c5503554c87e4de4035468bebf186205391ce9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66603243f5283f7f28c795f09e7c2167233df0bd\",\"lessThan\":\"27f380ef0e1d3de3cde114e02d33f9320ce3a5a6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/touchscreen/hynitron_cstxxx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/27f380ef0e1d3de3cde114e02d33f9320ce3a5a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/387829ee60de26c7c073ed4e27ecfab2b75d4c74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/38e7d5c1ade04b99c70da0298ca296ee62bc99c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51c5503554c87e4de4035468bebf186205391ce9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec61ca4e310665816a639cb2e46cd9b3af0a9bee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…