CVE-2026-64275
Received Received - Intake

Division by Zero in Elan I2C Touchpad Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces or y_traces, it results in a fatal division-by-zero exception leading to a kernel panic during device probe. Add checks to ensure these parameters are non-zero before performing the division. If invalid trace values are detected, fall back to a safe default of 1. Additionally, prevent an arithmetic underflow in the touch reporting logic. Previously, if the calculated or fallback width was smaller than ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a massive unsigned integer being reported to userspace. Clamp the adjusted width to a minimum of 0 to safely handle small physical dimensions and fallback scenarios. Completing the probe with safe fallback values ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64275
EUVD
EUVD-2026-48987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elan i2c *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Elan I2C touchpad driver. It occurs when the device firmware or device tree provides invalid zero values for x_traces or y_traces, causing a division-by-zero error during device probe. This leads to a kernel panic. The fix adds checks to ensure these values are non-zero before calculations and falls back to a safe default of 1 if invalid.

Detection Guidance

This vulnerability is specific to the Linux kernel's Elan I2C touchpad driver and may cause a kernel panic during device probe if invalid zero values are provided for x_traces or y_traces. Detection involves checking kernel logs for division-by-zero errors or arithmetic underflow related to the elan_i2c module.

Impact Analysis

If exploited, this vulnerability could cause your system to crash with a kernel panic when the touchpad is initialized, potentially leading to data loss or requiring a reboot. It may also prevent the touchpad from functioning properly until the system is restarted.

Mitigation Strategies

Apply the Linux kernel patch that adds checks for non-zero trace values and prevents arithmetic underflow. Ensure your system is running a kernel version that includes this fix. If you cannot patch immediately, consider disabling the Elan I2C touchpad driver if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart