Public bug reported:
After upgrading from Ubuntu 24.04 (kernel 6.8) to Ubuntu 26.04.1 LTS
(kernel 7.0.0-38-generic), the touchpad tap-to-click became unreliable:
single-finger taps are frequently not registered, and double-tapping to
open folders often takes several attempts. This worked perfectly on the
previous 6.8 kernel.
Hardware: "FocalTechPS/2 FocalTech Touchpad" (isa0060/serio4),
psmouse/focaltech driver.
GNOME touchpad settings are at defaults (tap-to-click enabled,
double-click 400 ms, click-method default), so this is not a
configuration issue.
The kernel log shows this UBSAN splat repeating while using the
touchpad:
UBSAN: array-index-out-of-bounds in drivers/input/mouse/focaltech.c:222:17
index -1 is out of range for type 'focaltech_finger_state [5]'
Call Trace:
focaltech_process_packet+0x4e1/0x560 [psmouse]
focaltech_process_byte+0x23/0x30 [psmouse]
psmouse_handle_byte+0x19/0x70 [psmouse]
psmouse_receive_byte+0x8d/0x300 [psmouse]
This matches CVE-2026-80574 (focaltech input driver: a finger index of 0
is decremented to -1 and used as an array offset), which is already fixed
upstream by making the finger index variables unsigned. Please backport
the fix to the Ubuntu 26.04 7.0.0 kernel.
Workaround: booting the still-installed 6.8.0-146-generic kernel restores
correct touchpad behaviour.
ProblemType: Bug
Release: Ubuntu 26.04.1 LTS
Affected kernel: 7.0.0-38-generic
Unaffected kernel: 6.8.0-146-generic
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-38-generic 7.0.0-38.38
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: jose 10161 F.... wireplumber
/dev/snd/controlC0: jose 10161 F.... wireplumber
/dev/snd/seq: jose 10153 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sat Oct 10 10:04:21 2026
HibernationDevice: RESUME=UUID=33c9a6d3-1565-44a6-b0f8-a86a8e80d835
InstallationDate: Installed on 2015-03-26 (4215 days ago)
InstallationMedia: Ubuntu-GNOME 14.10 "Utopic Unicorn" - Release amd64
(20141022.1)
MachineType: ASUSTeK COMPUTER INC. UX303LAB
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=93b239dc-6bd0-4aa5-8c7b-f58b1b09e7bd ro quiet
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
SourcePackage: linux
UpgradeStatus: Upgraded to resolute on 2026-10-10 (0 days ago)
dmi.bios.date: 12/11/2014
dmi.bios.release: 5.6
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: UX303LAB.203
dmi.board.asset.tag: ATN12345678901234567
dmi.board.name: UX303LAB
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: 1.0
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK COMPUTER INC.
dmi.chassis.version: 1.0
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvrUX303LAB.203:bd12/11/2014:br5.6:svnASUSTeKCOMPUTERINC.:pnUX303LAB:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnUX303LAB:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:skuASUS-NotebookSKU:pfaUX:
dmi.product.family: UX
dmi.product.name: UX303LAB
dmi.product.sku: ASUS-NotebookSKU
dmi.product.version: 1.0
dmi.sys.vendor: ASUSTeK COMPUTER INC.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170428
Title:
focaltech: UBSAN array-index-out-of-bounds (finger index -1) in
focaltech_process_packet on 7.0.0-38-generic — touchpad taps
unreliable
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170428/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
