← Back to CVE Explorer

CVE-2026-64271

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_interrupt() accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received *and* the device's two Y bytes agree: tw->data[tw->idx++] = data; if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) { ... tw->idx = 0; } The reset is gated on tw->data[1] == tw->data[2], a value the device controls. A malicious, malfunctioning or counterfeit Touchwindow peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the index reaches TW_LENGTH without the equality holding, is never reset, and keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte array and the rest of the heap-allocated struct tw, one attacker-chosen byte at a time -- an unbounded, device-driven heap out-of-bounds write. Reset the index on every completed packet and report an event only when the two Y bytes match, like the other serio touchscreen drivers do.

Severity
HIGH
CVSS score
7.8 (v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-25 10:17:07.410000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-64271",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-07-25T10:17:07.410",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: touchwin - reset the packet index on every complete packet\n\ntw_interrupt() accumulates each non-zero serial byte into a fixed\nthree-byte buffer with a running index that is only reset once a full\npacket has been received *and* the device's two Y bytes agree:\n\n\ttw->data[tw->idx++] = data;\n\tif (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {\n\t\t...\n\t\ttw->idx = 0;\n\t}\n\nThe reset is gated on tw->data[1] == tw->data[2], a value the device\ncontrols.  A malicious, malfunctioning or counterfeit Touchwindow\nperipheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the\nindex reaches TW_LENGTH without the equality holding, is never reset, and\nkeeps growing, so tw->data[tw->idx++] walks off the end of the three-byte\narray and the rest of the heap-allocated struct tw, one attacker-chosen\nbyte at a time -- an unbounded, device-driven heap out-of-bounds write.\n\nReset the index on every completed packet and report an event only when\nthe two Y bytes match, like the other serio touchscreen drivers do."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEntrada: touchwin - restablecer el índice del paquete en cada paquete completo\n\ntw_interrupt() acumula cada byte serie no nulo en un búfer fijo de tres bytes con un índice en ejecución que solo se restablece una vez que se ha recibido un paquete completo y los dos bytes Y del dispositivo coinciden:\n\n\ttw  ->  data[tw  ->  idx++] = data;\n\tif (tw  ->  idx == TW_LENGTH && tw  ->  data[1] == tw  ->  data[2]) {\n\t\t...\n\t\ttw  ->  idx = 0;\n\t}\n\nEl restablecimiento está condicionado a tw  ->  data[1] == tw  ->  data[2], un valor que el dispositivo controla. Un periférico Touchwindow malicioso, defectuoso o falsificado puede transmitir bytes no nulos cuyos 2º y 3º bytes difieren: el índice alcanza TW_LENGTH sin que se cumpla la igualdad, nunca se restablece y sigue creciendo, por lo que tw  ->  data[tw  ->  idx++] se sale del final del array de tres bytes y del resto de la estructura tw asignada en el heap, un byte elegido por el atacante a la vez -- una escritura fuera de límites en el heap, ilimitada y controlada por el dispositivo.\n\nRestablecer el índice en cada paquete completado y reportar un evento solo cuando los dos bytes Y coinciden, como lo hacen los otros controladores de pantalla táctil serio."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/input/touchscreen/touchwin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "ed9b66905407eb3d02df1aaeed82eb7a7f0eb508",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "044167cba2384bcd783547ad5e30ecd292b30919",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "6c9f29f128dd4057404838259af4c645318487e1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "431ad239f2924dff337c3fccb9246597c1b63185",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "70e4248793762df9832fd4fc2fc6ac7924572c36",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "3e6f007b43e2fc6546e21fa74ee62c38984a6672",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "a8d87184576c889759e3aab899799a482f1e1a5b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "lessThan": "478cdd736f2ce3114f90e775d7358136d3977b94",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/input/touchscreen/touchwin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2.6.19",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2.6.19",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.261",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.212",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.178",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.145",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.96",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.39",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.4",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.6.19",
              "versionEndExcluding": "5.10.261",
              "matchCriteriaId": "5E71338F-CDA6-41E2-BAC0-E66156032D53"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.212",
              "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "6.1.178",
              "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.6.145",
              "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.96",
              "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.18.39",
              "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.1.4",
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}