CVE-2026-64014
Received Received - Intake

Linux Kernel Out-of-Bounds Read in usbtouchscreen

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64014
EUVD
EUVD-2026-45587

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the usbtouchscreen driver for NEXIO devices. The issue occurs when the driver reads data_len and x_len values from a device packet header without proper bounds checking. These values can be manipulated to exceed the actual buffer size, leading to an out-of-bounds read of up to 64 KiB beyond the allocated memory. This allows adjacent kernel memory contents to leak into userspace via touch coordinate events.

Detection Guidance

This vulnerability is specific to the Linux kernel's usbtouchscreen driver and requires local system access to detect. Check if your system uses the affected driver by running: lsmod | grep usbtouchscreen. Monitor kernel logs for out-of-bounds read warnings or touchscreen input anomalies.

Impact Analysis

An attacker with physical access to a vulnerable system could exploit this flaw by connecting a malicious USB device. This could result in sensitive kernel memory being exposed to userspace, potentially leaking sensitive data such as passwords or encryption keys. In extreme cases, it might also cause system crashes by accessing unmapped memory pages.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized data exposure. The out-of-bounds read may leak kernel memory contents to userspace, which could include sensitive information. This could violate data protection principles under GDPR (e.g., integrity and confidentiality) and HIPAA (e.g., safeguarding protected health information).

Mitigation Strategies

Apply the kernel patch that clamps data_len and x_len to the URB buffer size. Update your Linux kernel to a version containing the fix. If immediate patching is not possible, disable the usbtouchscreen module temporarily with: sudo modprobe -r usbtouchscreen.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart