CVE-2026-80574

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

FocalTech FOC_REL packets reach focaltech_process_rel_packet through i8042/serio hardware interrupts, ps2_interrupt, psmouse_receive_byte, and focaltech_process_byte with no syscall gate; any local user on a laptop with an integrated FocalTech PS/2 touchpad can deliver the triggering bytes by normal touchpad use.

AC:LAttack complexity, low

When the second relative finger index is 0, a documented valid case for odd finger counts, signed underflow makes finger2 -1 pass the FOC_MAX_FINGERS bound test and causes a reliable out-of-bounds write on every such packet without races or attacker-uncontrollable memory layout.

PR:NPrivileges required, none

No Linux account, capability, or namespace privilege is required; the integrated touchpad feeds bytes directly into the kernel interrupt handler during normal operation, including at the login screen before authentication.

UI:NUser interaction, none

An attacker with brief local access can trigger the corrupting multitouch gestures directly on the touchpad; exploitation does not depend on a separate victim performing an unusual action beyond touching the device.

S:UScope, unchanged

The vulnerability corrupts kmalloc-allocated focaltech_data within the host kernel psmouse driver; impact is standard in-kernel memory corruption rather than crossing a guest/host, VM, or IOMMU security boundary.

C:HConfidentiality impact, high

Out-of-bounds += writes to fingers[-1].x and fingers[-1].y corrupt adjacent focaltech_data fields such as y_max in kernel heap memory; this class of heap corruption can be leveraged for kernel information disclosure.

I:HIntegrity impact, high

Attacker-influenced PS/2 packet bytes supply signed 8-bit deltas that repeatedly perform out-of-bounds writes immediately before fingers[0], enabling progressive corruption of neighboring driver state and potential privilege escalation.

A:HAvailability impact, high

Corrupting kmalloc-allocated driver state via fingers[-1] can destabilize the input subsystem or adjacent heap objects, causing kernel oops, panic, or repeatable denial of service on affected laptops.