CVE-2026-19576 zephyrproject CVE debrief

Who should care

Defenders responsible for systems using the Zephyr operating system with the Goodix GT911 touch controller should assess their exposure to this vulnerability. This includes developers and administrators of systems with pluggable display modules or shields, as these are potential attack vectors.

Why it matters

This vulnerability requires attention from defenders responsible for systems using the Zephyr operating system with the Goodix GT911 touch controller. The vulnerability can be triggered by a controller that reports more points than the array holds, and it requires control of, or the ability to substitute, the I2C touch controller. Defenders should prioritize verifying the touch controller's configuration and validating the device-reported touch point count to prevent potential stack corruption.

• Potential stack corruption leading to system instability or crashes.
• Possible elevation of privileges or arbitrary code execution.
• Increased risk of denial-of-service (DoS) attacks.
• Need for verification of touch controller configuration and validation of device-reported touch point count.

Technical summary

The Goodix GT911 touch controller driver in the Zephyr operating system is vulnerable to a stack out-of-bounds write. The driver reads the touch point count from the controller's status register and uses it directly as a loop bound for filling a stack array. If the controller reports more points than the array holds, up to 112 bytes of peer-supplied data can be written past the end of the array, potentially causing stack corruption.

Defensive priority

Defenders should prioritize verifying the touch controller's configuration and validating the device-reported touch point count to prevent potential stack corruption. They should also assess the exposure of their systems, particularly those with pluggable display modules or shields, and consider applying patches or workarounds provided by the vendor.

Recommended defensive actions

• Verify the touch controller's configuration to ensure it is properly set up and validated.
• Validate the device-reported touch point count to prevent potential stack corruption.
• Assess the exposure of systems, particularly those with pluggable display modules or shields.
• Apply patches or workarounds provided by the vendor to address the vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the lack of validation of the touch point count reported by the device. The Goodix GT911 touch controller driver reads the touch point count from the controller's status register and uses it directly as a loop bound for filling a stack array. This can lead to a stack out-of-bounds write if the controller reports more points than the array holds.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.