The Linux kernel Goodix touchscreen driver (goodix_ts_read_input_report) copies the number of touch points reported by the device into a fixed-size stack buffer sized for 10 contacts. The maximum touch count is read from a 4-bit field in the device configuration, which can report up to 15 contacts. Because this value is not clamped to the buffer size, a malicious or faulty device can cause the driver to write beyond the buffer boundary by up to 30 bytes, resulting in a stack out-of-bounds write. The fix clamps the maximum touch count to the buffer size (GOODIX_MAX_CONTACTS) to prevent this overflow.

This vulnerability can cause a stack out-of-bounds write in the kernel, potentially leading to memory corruption, system instability, or escalation of privileges if exploited. However, exploitation requires control or manipulation of the Goodix touchscreen device or the I2C bus, which limits the attack surface. No known exploits are reported in the wild at this time.

A fix is available and has been applied by clamping the maximum reported touch count to the buffer size. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended mitigation.