Array Out-of-Bounds Vulnerability in Linux Kernel - CVE-2026-80574
Summary
DEBIAN-CVE-2026-80574: In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the... Affects linux versions 5.10.103-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as CVE-2026-80574, which affects the focaltech driver responsible for handling touch input. This vulnerability can lead to severe security risks if exploited.
Vulnerability Detail
CVE-2026-80574 is an array out-of-bounds vulnerability in the focaltech driver of the Linux kernel. It originates from improper handling of finger index values in input packets. Specifically, when the finger index is 0, subtracting 1 results in an invalid negative array index, leading to potential memory corruption. This can allow an attacker to manipulate kernel memory, potentially leading to system crashes or unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds are mentioned for this vulnerability. However, it is advisable to limit access to the affected systems and monitor for unusual activity until the patch is applied.
Conclusion
CVE-2026-80574 is a critical vulnerability in the Linux kernel's focaltech driver that can lead to serious security risks. It is essential to update to the patched version to protect your systems from potential exploitation. Regular monitoring and updates are key to maintaining security.
See every vulnerability recorded for linux →
FAQ
CVE-2026-80574 is a vulnerability in the Linux kernel's focaltech driver that can lead to array out-of-bounds access, potentially allowing attackers to exploit kernel memory.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for CVE-2026-80574 is 8.4, indicating a high severity level that requires prompt attention.
Yes, a patch is available for Debian 13 (Trixie) in version 6.12.105-1. It is recommended to update to this version to mitigate the vulnerability.
If you cannot apply the patch immediately, limit access to the affected systems and monitor for any unusual activity until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
