CVE-2026-98206

What it actually does

Unbounded memcpy length derived from an untrusted HID report size field allows overflow of a fixed-size kernel response buffer in the cyttsp5 driver.

Why it matters to the business

Systems using affected Cypress touch controllers risk kernel memory corruption that can cause crashes, denial of service, or potential privilege escalation; widespread Linux deployments increase exposure surface across servers, desktops, and embedded devices.

How an attack unfolds

An attacker supplies a malicious HID report containing an oversized length field; the driver uses this value directly as the memcpy destination length, writing attacker-controlled data past the end of the response buffer and corrupting adjacent kernel structures.

How to fix it

Apply the upstream kernel patch that clamps the HID report size to CY_MAX_INPUT before the memcpy call; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Confirm the presence of the clamping check in the cyttsp5 HID report handling function and verify that oversized reports are truncated rather than copied verbatim.

Typical attack path

1. Obtain or emulate a cyttsp5-compatible HID input device
2. Craft an HID report with a size field larger than CY_MAX_INPUT
3. Present the report to the kernel driver via the input subsystem
4. Trigger the vulnerable memcpy path during report processing
5. Leverage resulting memory corruption for code execution or crash

How to detect it

Review kernel logs for buffer-overrun warnings or oops traces involving cyttsp5 HID report processing; inspect input event traces for anomalous report lengths.

What your security team should do

• Prioritize kernel updates on any systems exposing cyttsp5 or similar HID input drivers
• Monitor vendor advisories for backported fixes in distribution kernels
• Disable unused touchscreen drivers via kernel configuration where feasible