CVE-2026-64272

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel MMS114 Touch Driver

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When __mms114_read_reg() reads the touch data packet from the device into the touch buffer, the events are packed tightly at 6-byte intervals. However, the driver iterates through the events using standard C array indexing (touch[index]), where each element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any touch events beyond the first one are read from incorrect offsets and parsed improperly. Fix this by explicitly calculating the byte offset for each touch event based on the device's specific event size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64272

EUVD

EUVD-2026-48984

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.13 (inc) to 6.6.145 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's MMS114 driver for MMS134S and MMS136 touch controllers. The issue occurs because the touch events are stored in 6-byte packets, but the driver incorrectly reads them using 8-byte array indexing. This causes misalignment, leading to improper parsing of touch events beyond the first one.

Detection Guidance

This vulnerability is specific to Linux kernel touch controller drivers (MMS114) and cannot be detected via network scans or generic commands. Check if your system uses the affected MMS134S or MMS136 touch controllers by examining kernel logs for mms114 driver errors or unexpected touch input behavior.

Impact Analysis

This vulnerability could cause touch input errors on devices using MMS134S or MMS136 touch controllers. Users might experience incorrect touch detection, misaligned inputs, or unresponsive touch functionality, potentially disrupting normal device operation.

Compliance Impact

This vulnerability affects touch input handling in the Linux kernel but does not directly impact compliance with standards like GDPR or HIPAA. It is a driver-level issue that could lead to incorrect touch event processing, potentially causing system instability or misbehavior. No evidence suggests it involves data exposure or privacy violations.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If you are using a custom or vendor kernel, apply the upstream patch for the mms114 driver. Monitor touch input functionality after updating to ensure proper operation.

Hi! I’m here to help you understand CVE-2026-64272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70