← Back to CVE Explorer

CVE-2026-64270

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114_interrupt() reads a packet of touch data from the device into a fixed-size on-stack buffer struct mms114_touch touch[MMS114_MAX_TOUCH]; which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes, i.e. 80 bytes. The length of the I2C read into it is taken verbatim from the device: packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE); if (packet_size <= 0) goto out; ... error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size, (u8 *)touch); packet_size is a single device register byte (0x0F) and the only check is the lower bound packet_size <= 0; it is never bounded against the size of touch[]. A malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can report a packet_size of up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of touch[] on the IRQ-thread stack: a stack out-of-bounds write that can overwrite the stack canary, saved registers and the return address. A well-formed device never reports more than the buffer holds, so reject an oversized packet and drop the report, consistent with the handler's other error paths, rather than reading past the buffer.

Severity
HIGH
CVSS score
7.8 (v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-25 10:17:07.293000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-64270",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-07-25T10:17:07.293",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - reject an oversized device packet size\n\nmms114_interrupt() reads a packet of touch data from the device into a\nfixed-size on-stack buffer\n\n\tstruct mms114_touch touch[MMS114_MAX_TOUCH];\n\nwhich holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,\ni.e. 80 bytes. The length of the I2C read into it is taken verbatim from\nthe device:\n\n\tpacket_size = mms114_read_reg(data, MMS114_PACKET_SIZE);\n\tif (packet_size <= 0)\n\t\tgoto out;\n\t...\n\terror = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,\n\t\t\t(u8 *)touch);\n\npacket_size is a single device register byte (0x0F) and the only check\nis the lower bound packet_size <= 0; it is never bounded against the\nsize of touch[]. A malfunctioning, malicious or counterfeit controller\n(or an attacker tampering with the I2C bus) can report a packet_size of\nup to 255, so __mms114_read_reg() writes up to 175 bytes past the end of\ntouch[] on the IRQ-thread stack: a stack out-of-bounds write that can\noverwrite the stack canary, saved registers and the return address.\n\nA well-formed device never reports more than the buffer holds, so reject\nan oversized packet and drop the report, consistent with the handler's\nother error paths, rather than reading past the buffer."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEntrada: mms114 - rechazar un tamaño de paquete de dispositivo sobredimensionado\n\nmms114_interrupt() lee un paquete de datos táctiles del dispositivo en un búfer de tamaño fijo en la pila\n\n\tstruct mms114_touch touch[MMS114_MAX_TOUCH];\n\nque contiene MMS114_MAX_TOUCH (10) eventos de MMS114_EVENT_SIZE (8) bytes, es decir, 80 bytes. La longitud de la lectura I2C en él se toma textualmente del dispositivo:\n\n\tpacket_size = mms114_read_reg(data, MMS114_PACKET_SIZE);\n\tif (packet_size menor o igual que 0)\n\t\tgoto out;\n\t...\n\terror = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,\n\t\t\t(u8 *)touch);\n\npacket_size es un solo byte de registro del dispositivo (0x0F) y la única comprobación es el límite inferior packet_size menor o igual que 0; nunca se limita contra el tamaño de touch[]. Un controlador defectuoso, malicioso o falsificado (o un atacante manipulando el bus I2C) puede informar un packet_size de hasta 255, por lo que __mms114_read_reg() escribe hasta 175 bytes más allá del final de touch[] en la pila del hilo IRQ: una escritura fuera de límites de la pila que puede sobrescribir el canario de la pila, los registros guardados y la dirección de retorno.\n\nUn dispositivo bien formado nunca informa más de lo que contiene el búfer, por lo tanto, rechazar un paquete sobredimensionado y descartar el informe, consistente con otras rutas de error del gestor, en lugar de leer más allá del búfer."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/input/touchscreen/mms114.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "040843281eebfa110d08fd7fb083fe6cb55cea14",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "39b12daf1adb80f9595fdfe584961deb80860cbb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "d99ba93c35ff2d5276e9c2632967481bd53a79d0",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "b78150729762d47c14fe29a2582bdca5568e62b8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "8301c335305344d4da4ab9442b6a399dacfe5b8d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "f3d5e77b27fded71dcb97f409262bf0abba0410e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "07b8481d4aff73d6f451f25e74ea10240ff5131e",
              "lessThan": "66725039f7090afe14c31bd259e2059a68f04023",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/input/touchscreen/mms114.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.6",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.6",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.266",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.217",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.184",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.145",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.96",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.39",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.4",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.6",
              "versionEndExcluding": "6.6.145",
              "matchCriteriaId": "A002694E-FCEC-401E-A2AC-04C88AB8217F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.96",
              "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.18.39",
              "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.1.4",
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/040843281eebfa110d08fd7fb083fe6cb55cea14",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/39b12daf1adb80f9595fdfe584961deb80860cbb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/66725039f7090afe14c31bd259e2059a68f04023",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/8301c335305344d4da4ab9442b6a399dacfe5b8d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/b78150729762d47c14fe29a2582bdca5568e62b8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d99ba93c35ff2d5276e9c2632967481bd53a79d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f3d5e77b27fded71dcb97f409262bf0abba0410e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}