CVE-2018-19939: Mi a2 Lite Firmware

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

The Goodix GT9xx touchscreen driver for custom Linux kernels on Xiaomi daisy-o-oss and daisy-p-oss as used in Mi A2 Lite and RedMi6 pro devices through 2018-08-27 has a NULL pointer dereference in kfree after a kmalloc failure in gtp_read_Color in drivers/input/touchscreen/gt917d/gt9xx.c.

Affected products

• Mi Mi a2 Lite Firmware: up to and including 2018-08-27
• Mi Redmi 6 Firmware: up to and including 2018-08-27

Published 2018-12-07. Last modified 2026-06-17.