CVE-2026-19576

Executive Summary

CVE-2026-19576 is a stack-based buffer overflow (CWE-787) in the Linux kernel Goodix GT9xx touchscreen input driver (drivers/input/input_gt911.c). The driver uses an unvalidated touch-point count read from the I2C controller's status register as a loop bound when writing into point_reg[], a stack array sized by the CONFIG_INPUT_GT911_MAX_TOUCH_POINTS Kconfig option (range 1..5). A device reporting up to 15 points, or bus corruption of a single status byte, causes an out-of-bounds write of up to 112 bytes of peer-supplied data into the stack frame of gt911_process() running in the system workqueue thread, plus two subsequent out-of-bounds reads. Because exploitation requires control of, or substitution of, the I2C touch controller, the practical prerequisite is physical access to the pluggable display module or shield — reflected in the CVSS base score of 6.8 with the Access Vector subscore of Physical. Systems shipping GT9xx-based pluggable panel modules without write-protected I2C attachment or kernel hardening are at risk of local privilege escalation up to kernel code execution, with no patch currently available.

Technical Analysis

The vulnerability resides in the Goodix GT911/GT9xx input driver. At init, the driver programs the controller to report no more touch points than the configured maximum; this constraint is documented only in a source comment — no runtime enforcement exists.

The failure chain is as follows:

1. Untrusted bound acquisition. The driver reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F). This yields an unchecked value in the range 0..15.
2. Missing bounds check. In gt911_process(), that masked value is used directly as the loop bound for filling point_reg[]. No code validates it against the array capacity.
3. Undersized destination. point_reg[] is a stack array sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS, whose Kconfig range is 1..5 with a default of 1. The maximum legitimate capacity is therefore five entries — while the attacker-influenced count can reach fifteen.
4. Out-of-bounds write. Each loop iteration issues an I2C read of eight bytes written straight into point_reg[i]. With up to 15 iterations against a 5-element array, up to 10 iterations write past the end, resulting in up to 112 bytes (14 × 8) of peer-supplied data being written beyond the buffer, overwriting the stack frame of gt911_process() executing in the system workqueue thread.
5. Out-of-bounds reads. Two further loops subsequently read out of bounds from the same array, expanding information-disclosure and crash potential.

Trigger paths (three, per the description):

• Adversarial: An attacker who controls or substitutes the I2C touch controller. A spoofed device need only answer the init probes with a supported product ID and a checksum-valid config blob, then report an inflated point count. This is plausible on the many supported boards where the GT9xx panel is a pluggable display module or shield rather than an on-PCB part.
• Non-adversarial (GT9271-class): A GT9271-class panel that ignores the driver's touch-count programming and reports up to ten points causes the same overflow without attacker intent.
• Random/bus fault: Corruption of the single status byte on the I2C bus can also produce an out-of-range count.

The affected surface is the kernel input subsystem's workqueue execution context, giving the overflow direct access to kernel stack memory. The vulnerability class (CWE-787) and the use of a peer-supplied length as a stack write bound are classic kernel memory-corruption primitives.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the vulnerability class and the mechanism described in the NVD entry. Specific function names, paths, and constants referenced are those appearing verbatim in the description.

1. Reconnaissance / target identification. An attacker identifies a target device whose GT9xx touch panel is implemented as a pluggable module or shield on an exposed I2C bus. This is a physical access precondition. The attacker characterizes the init handshake: the driver probes the controller, expects a supported product ID and a checksum-valid config blob, and programs a touch-count limit that it never re-verifies.

2. Triggering the flaw. The attacker substitutes or emulates the touch controller. The rogue device answers init probes with a supported product ID and a checksum-valid config blob to pass driver initialization. It then reports a touch point count in the status register exceeding the configured maximum (up to 15 via GT911_TOUCH_POINTS_MSK = 0x0F). Because gt911_process() uses this count directly as the point_reg[] loop bound with no cross-check, the loop overruns the array.

3. Payload / execution method. Each overrunning iteration performs an I2C read of eight bytes written directly into the out-of-bounds stack slot. The attacker-controlled device therefore supplies the overflowing bytes, affording up to 112 bytes of contiguous stack overwrite in the system workqueue thread's gt911_process() frame. This is a classic kernel stack corruption primitive: the attacker shapes the overwrite to target control data (e.g., saved return state) in the workqueue context. The subsequent two out-of-bounds reads can leak adjacent stack contents back through the driver's normal data path, aiding layout discovery. The non-adversarial GT9271-class path (up to ten points) and single-byte I2C bus corruption provide additional reachability without an emulated controller.

4. Post-exploitation impact. Successful corruption of the workqueue stack frame can lead to kernel code execution or privilege escalation in the context of the kernel; failure typically manifests as a kernel panic or memory corruption crash. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) reflects high confidentiality, integrity, and availability impact confined to the vulnerable component, with no authentication or user interaction required once physical access to the bus is achieved.

Impact Assessment

• Scope of impact: Kernel-level stack memory corruption in the input driver's workqueue thread. The CVSS vector assigns High impact to Confidentiality (out-of-bounds reads), Integrity (attacker-controlled overwrite), and Availability (likely crash/panic on failure).
• Exploitability posture: AV:P (Physical) is the dominant limiting factor — the attacker must control or substitute the I2C controller. AC:L (Low complexity) and PR:N (no privileges) mean that once physical bus access exists, no additional barriers apply. UI:N indicates no user interaction.
• Blast radius: All Linux systems running the affected Goodix GT9xx input driver with the vulnerable touch-count handling. The Kconfig default of 1 for CONFIG_INPUT_GT911_MAX_TOUCH_POINTS makes the overflow window especially large on default-configured builds (up to 14 overflowing iterations). Devices on which the GT9xx panel is a pluggable module or shield — commonly single-board computers, tablets, handhelds, and kiosk hardware — are the primary exposure. Non-adversarial triggers (GT9271-class panels, I2C bus corruption) make spontaneous crashes plausible on otherwise benign hardware, increasing availability risk beyond deliberate attack scenarios.
• Business impact: For kiosk, industrial HMI, and consumer handheld deployments, physical-access attackers with brief custody of a device could attempt kernel compromise. Even absent exploitation, the instability inherent to this bug (unintended overflow from a compliant panel) presents a reliability and support cost.
• Threat activity: CISA KEV status is NO. No exploit-in-the-wild evidence, no PoC, no Nuclei template, and no known threat-actor campaign are associated with this CVE at the time of writing.

Detection Guidance

Because the attack surface is a physical I2C bus rather than a network protocol, network-layer detection is limited to host telemetry correlation and kernel log monitoring. The signatures below focus on kernel crash/panic anomalies, driver fault reporting, and physical-access/device-substitution artifacts.

Sigma Rule

title: Potential Goodix GT9xx Touch Driver Stack Overflow (CVE-2026-19576)
id: 8e2f1c4a-3b7d-4f9a-9c21-5d6a7b0e9f13
status: experimental
description: Detects kernel log indicators consistent with the gt911_process() stack buffer overflow in the Goodix GT9xx input driver, including stack corruption and input-subsystem faults.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19576
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - "input_gt911"
    - "gt911_process"
    - "stack-out-of-bounds"
    - "I2C"
    - "Goodix"
  condition: keywords
falsepositives:
  - Legitimate driver load/unload messages on GT9xx-equipped hardware
level: medium
tags:
  - attack.t1190
  - cve.2026-19576

YARA Rule

rule CVE_2026_19576_Goodix_GT911_Strings
{
    meta:
        description = "Detects references to the Goodix GT9xx input driver and glyphs associated with CVE-2026-19576 in kernel images, modules, or forensic dumps"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19576"
        date = "2026-01-01"
    strings:
        $s1 = "input_gt911" ascii
        $s2 = "gt911_process" ascii
        $s3 = "GT911_TOUCH_POINTS_MSK" ascii
        $s4 = "GT911_MAX_TOUCH_POINTS" ascii
        $s5 = "gt911" ascii nocase
    condition:
        any of them
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-19576 Goodix GT9xx Driver Memory Corruption - Out-of-Bounds Stack Write Indicator"; flow:established; content:"input_gt911"; nocase; classtype:attempted-admin; sid:2026001957; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-19576;)

Elastic Detection

sequence by host.id
  [process where event.category == "driver" and process.name : "init_gt911" ]
  [file where event.category == "driver" and file.name : "input_gt911.c" ]

Note: EQL field names for kernel driver telemetry vary by collection source; adjust mappings to the sensor in use (Auditbeat/Elastic Defend kernel module telemetry).

Splunk SPL Query

index=linux_kernel ("gt911" OR "GT911" OR "input_gt911" OR "gt911_process")
| stats count by host, _raw
| where match(_raw, "(?i)(stack-out-of-bounds|bad page state|general protection fault|kernel panic|oom-kill)")
| sort - count

Wazuh OSSEC Rule

<group name="linux_kernel,cve_2026_19576,">
  <rule id="100957" level="10">
    <decoded_as>kernel</decoded_as>
    <match>gt911|input_gt911|gt911_process</match>
    <description>CVE-2026-19576: Goodix GT9xx driver event detected - possible stack buffer overflow in gt911_process()</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100958" level="12">
    <decoded_as>kernel</decoded_as>
    <match>stack-out-of-bounds|general protection fault|kernel panic</match>
    <description>CVE-2026-19576: Kernel memory corruption crash consistent with Goodix GT9xx touch driver overflow</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch source, or documented workaround is available as of analysis time.

1. Immediate mitigations

• Disable the driver on systems that do not require Goodix touch input. Blacklist or do not build input_gt911 (CONFIG_INPUT_GT911); where touch is required, this is not viable, but on headless or non-GT9xx hardware it eliminates the attack surface entirely.
• Physical hardening. On systems where the GT9xx panel is a pluggable module or shield, restrict physical access: use chassis locks/security screws, tamper-evident seals, and security-monitored enclosures. Mount pluggable display headers on internal, non-user-accessible connectors where the hardware design permits.
• Kconfig tuning. Raising CONFIG_INPUT_GT911_MAX_TOUCH_POINTS to the maximum (5) does not remediate the bug — the reported count can reach 15 — but it narrows the overflow window. This should be treated only as a hardening stopgap, not a fix.
• Bus integrity. Reduce the bus-corruption trigger path by keeping I2C pull-ups/topology within specification and avoiding long or noisy touch-controller wiring.
• Runtime hardening. Enable kernel memory protections (KASLR, CONFIG_STACKPROTECTOR_STRONG, page poisoning) to raise the bar for reliable exploitation and increase the chance a corruption event becomes a contained crash rather than code execution.

2. Patch / upgrade steps

• No patch is currently available. Track the upstream Linux kernel input subsystem and Goodix driver maintainers for a fix that adds a runtime bounds check on the reported touch-point count before it is used as the point_reg[] loop bound.
• Monitor the NVD entry (CVE-2026-19576) and distro security advisories (Debian, Ubuntu, Fedora, Yocto/OpenEmbedded BSPs) for backported patches.
• Once a patched kernel or module is published, apply it promptly; validate the gt911_process() bound check in the fix before deployment.

3. Long-term hardening

• Adopt a security review practice for out-of-tree and vendor input drivers that treats all controller-supplied lengths/counts as untrusted and enforces explicit bounds against destination capacity.
• Require secure physical design for consumer/industrial devices with user-removable peripherals, treating pluggable touch panels as untrusted input devices.
• Maintain asset inventory of devices using the Goodix GT9xx to prioritize patching when a fix lands.
• Feed kernel crash telemetry (stack-out-of-bounds, panic events referencing gt911/input_gt911) into the SOC for early warning of both attempted exploitation and the non-adversarial trigger path.

References

1. NVD — CVE-2026-19576: https://nvd.nist.gov/vuln/detail/CVE-2026-19576
2. MITRE CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Linux kernel input subsystem / Goodix GT9xx driver source tree (drivers/input/input_gt911.c) — upstream review for pending fix
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-19576: NOT listed at time of writing (no known exploitation in the wild)

No known threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-19576 as of this report.