---
id: CVE-2026-80574
title: 'Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

  Make finger2 (and also finger1) unsigned, so that if the finger index in
  the packet is 0 the…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    063b4c6a6f3fc01bca085c442000c9c100fdbd93
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    ca92c98b806839c108995b2bbff7061515bdfb53
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    81b07470cb2937ceb74b00be88151582a322433b
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    6f6d5fe29efdf5001bc146fc292e6592cace93eb
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    83c265bfc084d77e2171d4b67362150ab38c935b
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    1842e47126816e56d30c4f856f9854fd7831066c
  - >-
    Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 <
    296736076b3fd078742651c719555a488624023a
  - Linux 4.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:17:38.877243Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:27.544Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80574'
references:
  - url: 'https://git.kernel.org/stable/c/063b4c6a6f3fc01bca085c442000c9c100fdbd93'
  - url: 'https://git.kernel.org/stable/c/bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f'
  - url: 'https://git.kernel.org/stable/c/ca92c98b806839c108995b2bbff7061515bdfb53'
  - url: 'https://git.kernel.org/stable/c/81b07470cb2937ceb74b00be88151582a322433b'
  - url: 'https://git.kernel.org/stable/c/6f6d5fe29efdf5001bc146fc292e6592cace93eb'
  - url: 'https://git.kernel.org/stable/c/83c265bfc084d77e2171d4b67362150ab38c935b'
  - url: 'https://git.kernel.org/stable/c/1842e47126816e56d30c4f856f9854fd7831066c'
  - url: 'https://git.kernel.org/stable/c/296736076b3fd078742651c719555a488624023a'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.02466
ingestedAt: '2026-10-16T19:46:24.314Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Make finger2 (and also finger1) unsigned, so that if the finger index in
the packet is 0 then subtracting 1 creates an array index which overflows
above the existing check for FOC_MAX_FINGERS, as the existing comment says
it should, instead of writing to state->fingers[-1].

## Affected

- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < 063b4c6a6f3fc01bca085c442000c9c100fdbd93`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < ca92c98b806839c108995b2bbff7061515bdfb53`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < 81b07470cb2937ceb74b00be88151582a322433b`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < 6f6d5fe29efdf5001bc146fc292e6592cace93eb`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < 83c265bfc084d77e2171d4b67362150ab38c935b`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < 1842e47126816e56d30c4f856f9854fd7831066c`
- `Linux >= 05be1d079ec0b3691783e4384b1ada82149ff7d2 < 296736076b3fd078742651c719555a488624023a`
- `Linux 4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.