CVE-2025-68777

Vulnerability

Description

In the TI AM335x touchscreen controller (TSC) driver within the Linux kernel, an off-by-one error exists in the validation of the wire_order array. The check wire_order[i] > ARRAY_SIZE(config_pins) permits values equal to ARRAY_SIZE(config_pins) (which is 4) to pass validation. Since config_pins config_pins` is a 4-element array (indices 0–3), a value of 4 leads to an out-of-bounds read/write when used as an index [1][2][3].

Exploitation and

Attack Surface

The vulnerability can be triggered through specially crafted input that sets wire_order elements to invalid values (>=4). No special privileges are required beyond the ability to interact with the TSC device interface. The attack surface is local, and exploitation would typically require physical access or a malicious program running on the system.

Impact

An attacker could use this bug to read or write memory outside the config_pins array, potentially causing memory corruption, denial of service (kernel panic), or in some cases privilege escalation. The specific impact depends on system memory layout and the attacker's ability to control the ability to control the out-of-bounds index [1][2][3].

Mitigation

The fix changes the comparison from > to >=, ensuring only indices 0–3 are accepted. The commit is merged in stable kernel trees. Users should apply the latest kernel updates containing this patch [1].