CVE-2026-19576: bounds in zephyrproject zephyr

The Goodix GT9xx input driver in Zephyr reads the touch point count from the controller's status register and masks it to a value between 0 and 15. This value is used directly as the loop bound for filling a stack array sized according to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS, which ranges from 1 to 5. No additional checks constrain the count, relying on the controller to report no more points than configured. If the controller reports more points, up to 112 bytes of data can be written past the end of the array, causing a stack buffer overflow. This overflow can lead to out-of-bounds reads, crashes, and potential control-flow hijacking with kernel privileges. Exploitation requires control or substitution of the I2C touch controller, which is plausible on devices where the GT9xx panel is a pluggable module. The vulnerability affects Zephyr versions from 4.0.0 up to and including 4.4.2. The patch clamps the reported count with a minimum function against the configured maximum touch points before any array indexing.

The vulnerability allows an attacker with physical or local hardware access to cause a stack buffer overflow in the kernel by supplying a malicious touch controller that reports more touch points than the driver expects. This can lead to out-of-bounds writes and reads on the stack, potentially resulting in kernel privilege escalation and control-flow hijacking on the host MCU. There is no remote or network-based attack vector. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS score of 6.8.

A fix is available that clamps the reported touch point count to the configured maximum before using it as a loop bound, preventing out-of-bounds array access. Users should update Zephyr to a version later than 4.4.2 where this fix is applied. Since the attack requires physical or local hardware access to the I2C touch controller, limiting such access also mitigates risk.