An out‑of‑bounds write occurs in the Linux kernel’s focaltech touchscreen driver. The code subtracts one from a finger index received in a packet and then uses the result as an array offset. If the packet contains a zero index, the subtraction produces –1, which indexes state->fingers[-1] and writes beyond the allocated array. This memory corruption can overwrite adjacent kernel data. The available information does not confirm a privilege‑escalation exploit; it only indicates potential for unintended memory modification.

The flaw exists in any Linux kernel that includes the focaltech driver and no patch. Distributions that ship standard kernels with this driver are impacted until the commit adding the bounds check is integrated. The affected module is present in the “focaltech” touchscreen interface, commonly used in devices such as smartphones or tablets running Linux. No specific kernel versions are listed, so the vulnerability is considered present in all unfixed versions containing the driver.

The CVSS base score is 8.4, indicating a high severity. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not in the CISA KEV catalog. Attack requires access to the device that presents a focaltech touchscreen, either by sending crafted input locally or by compromising a device that receives touch data. An attacker would need to trigger the out‑of‑bounds write to achieve memory corruption; direct evidence of remote exploitation is not documented, but the high CVSS suggests that such exploitation could be high impact if feasible.