Local privilege escalation via touchscreen driver writes

Out-of-bounds writes in Google's Android ftm4_touch kernel driver allow local users to escalate privileges through sysfs handlers. The store_upgrade and store_cmd handlers in drivers/input/touchscreen/stm/ftm4_pdc.c write beyond buffer bounds because checks are missing and integer subtraction can underflow. Exploitation requires low-privileged local access to a device using the affected touchscreen driver and can compromise kernel-controlled data and execution.