CVE-2026-80574 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, especially those using the focaltech input module, should assess their exposure and prioritize patching this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify patch deployment, assess exposure, and monitor systems for potential exploitation attempts.

Why it matters

CVE-2026-80574 is a high-severity vulnerability in the Linux kernel's focaltech input module that could allow out-of-bounds writes. Defenders should prioritize patching and monitoring systems for potential exploitation attempts.

• Verify patch deployment to prevent out-of-bounds writes.
• Assess exposure of Linux kernel-based systems using the focaltech input module.
• Monitor systems for suspicious activity related to the focaltech input module.
• Update incident response plans to include procedures for handling potential exploitation attempts.

Technical summary

The CVE-2026-80574 vulnerability is caused by the improper handling of finger index values in the `focaltech_process_rel_packet` function. The issue can be resolved by making the finger index values unsigned, preventing the array index overflow. This vulnerability affects Linux kernel-based systems using the focaltech input module, allowing an attacker to write data out-of-bounds. Defenders should prioritize patching this vulnerability, especially in systems where the focaltech input module is used. The existing check for FOC_MAX_FINGERS ensures that the finger index does not exceed the maximum allowed value.

Defensive priority

Defenders should prioritize patching this vulnerability, especially in systems where the focaltech input module is used.

Recommended defensive actions

• Patch the Linux kernel to the latest version that includes the fix for CVE-2026-80574.
• Review and update the focaltech input module to ensure it is properly configured and secured.
• Monitor systems for any suspicious activity related to the focaltech input module.
• Verify patch deployment to prevent out-of-bounds writes.
• Assess exposure of Linux kernel-based systems using the focaltech input module.
• Update incident response plans to include procedures for handling potential exploitation attempts.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was resolved by making the finger index values unsigned, preventing the array index overflow. The existing check for FOC_MAX_FINGERS ensures that the finger index does not exceed the maximum allowed value.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.