CVE-2026-64272: Input: mms114 - fix touch indexing for MMS134S and MMS136

CVE-2026-64272: Input: mms114 - fix touch indexing for MMS134S and MMS136

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Input: mms114 - fix touch indexing for MMS134S and MMS136

The MMS134S and MMS136 touch controllers have an event size of 6 bytes
rather than 8 bytes. When __mms114_read_reg() reads the touch data
packet from the device into the touch buffer, the events are packed
tightly at 6-byte intervals. However, the driver iterates through the
events using standard C array indexing (touch[index]), where each
element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any
touch events beyond the first one are read from incorrect offsets and
parsed improperly.

Fix this by explicitly calculating the byte offset for each touch event
based on the device's specific event size.

The Linux kernel CVE team has assigned CVE-2026-64272 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.13 with commit 53fefdd1d3a3403d8c44e28898d1031d8763b913 and fixed in 6.6.145 with commit 112666835071d935fef764aab590339e97216d4a
	Issue introduced in 5.13 with commit 53fefdd1d3a3403d8c44e28898d1031d8763b913 and fixed in 6.12.96 with commit 7c00a0787af7164438bdbc97fcae9733cfc58d21
	Issue introduced in 5.13 with commit 53fefdd1d3a3403d8c44e28898d1031d8763b913 and fixed in 6.18.39 with commit 75b12874b4172533b9efc349db328cb1a59c3981
	Issue introduced in 5.13 with commit 53fefdd1d3a3403d8c44e28898d1031d8763b913 and fixed in 7.1.4 with commit a747c4eb02656afdbd92eea83b88e92715a23977
	Issue introduced in 5.13 with commit 53fefdd1d3a3403d8c44e28898d1031d8763b913 and fixed in 7.2-rc1 with commit a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64272
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/input/touchscreen/mms114.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a
	https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21
	https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981
	https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977
	https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d