From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
Date: Sun, 19 Jul 2026 16:57:54 +0200 [thread overview]
Message-ID: <2026071909-CVE-2026-64014-d94b@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
nexio_read_data() pulls data_len and x_len from a packed __be16 header
in the device's interrupt packet and then walks packet->data[0..x_len)
and packet->data[x_len..data_len) comparing each byte against a
threshold.
Both fields are 16-bit on the wire (max 65535). The existing
adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size
(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
packed header — so packet->data[] has 1017 valid bytes. read_data()
callbacks are not given urb->actual_length, and nothing else bounds the
walk.
A device that lies about its length can get a ~64 KiB out-of-bounds read
past the coherent DMA allocation. The first index whose byte exceeds
NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
reported touch coordinates, so adjacent kernel memory contents leak to
userspace as ABS_X / ABS_Y events. Far enough out, the read can also
hit an unmapped page and fault.
Fix this all by clamping data_len to the buffer's data[] capacity and
x_len to data_len.
The Linux kernel CVE team has assigned CVE-2026-64014 to this issue.
Affected and fixed versions
===========================
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 5.10.259 with commit 45c829e5eb3b974282bae50b7cca2cc891f74f0b
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 5.15.210 with commit e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.1.176 with commit 95f47331dfde243f93e679ce70bd0c24b37c683d
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.6.143 with commit d883312061ccde8c536595998aaf687ec070077c
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.12.93 with commit 103d2de9f505f56da173e43f12dba62f92620278
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.18.35 with commit 0ca809ea8e0355299266c46e5f1755040aa8dcf3
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 7.0.12 with commit 7585b6aa55d8ac85ad22f522e1059f93507727b6
Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 7.1 with commit 2905281cbda52ec9df540113b35b835feb5fafd3
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-64014
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/input/touchscreen/usbtouchscreen.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b
https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb
https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d
https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c
https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278
https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3
https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6
https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3
reply other threads:[~2026-07-19 15:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026071909-CVE-2026-64014-d94b@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox