CVE-2026-64272
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When __mms114_read_reg() reads the touch data packet from the device into the touch buffer, the events are packed tightly at 6-byte intervals. However, the driver iterates through the events using standard C array indexing (touch[index]), where each element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any touch events beyond the first one are read from incorrect offsets and parsed improperly. Fix this by explicitly calculating the byte offset for each touch event based on the device's specific event size.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-25 10:17:07.550000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-64272",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-25T10:17:07.550",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: mms114 - fix touch indexing for MMS134S and MMS136\n\nThe MMS134S and MMS136 touch controllers have an event size of 6 bytes\nrather than 8 bytes. When __mms114_read_reg() reads the touch data\npacket from the device into the touch buffer, the events are packed\ntightly at 6-byte intervals. However, the driver iterates through the\nevents using standard C array indexing (touch[index]), where each\nelement is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any\ntouch events beyond the first one are read from incorrect offsets and\nparsed improperly.\n\nFix this by explicitly calculating the byte offset for each touch event\nbased on the device's specific event size."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEntrada: mms114 - corrección de la indexación táctil para MMS134S y MMS136\n\nLos controladores táctiles MMS134S y MMS136 tienen un tamaño de evento de 6 bytes en lugar de 8 bytes. Cuando __mms114_read_reg() lee el paquete de datos táctiles del dispositivo en el búfer táctil, los eventos se empaquetan de forma compacta en intervalos de 6 bytes. Sin embargo, el controlador itera a través de los eventos utilizando la indexación estándar de arrays de C (touch[índice]), donde cada elemento está separado por sizeof(struct mms114_touch) (8 bytes). Como resultado, cualquier evento táctil más allá del primero se lee desde desplazamientos incorrectos y se analiza incorrectamente.\n\nSolucione esto calculando explícitamente el desplazamiento de bytes para cada evento táctil basado en el tamaño de evento específico del dispositivo."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/input/touchscreen/mms114.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "062bbe55a1f6d77b89d07135ba3b09f97bfac1cb",
"versionType": "git",
"status": "affected"
},
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "38de2979d90d8cd94f18e0567be4c8342d0e0410",
"versionType": "git",
"status": "affected"
},
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "112666835071d935fef764aab590339e97216d4a",
"versionType": "git",
"status": "affected"
},
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "7c00a0787af7164438bdbc97fcae9733cfc58d21",
"versionType": "git",
"status": "affected"
},
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "75b12874b4172533b9efc349db328cb1a59c3981",
"versionType": "git",
"status": "affected"
},
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "a747c4eb02656afdbd92eea83b88e92715a23977",
"versionType": "git",
"status": "affected"
},
{
"version": "53fefdd1d3a3403d8c44e28898d1031d8763b913",
"lessThan": "a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/input/touchscreen/mms114.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.13",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.13",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.217",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.184",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.145",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.96",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.39",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.4",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-129"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13",
"versionEndExcluding": "6.6.145",
"matchCriteriaId": "A8617408-1AB4-4CBE-BC49-5A1EAAFE7233"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.96",
"matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.39",
"matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.1.4",
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/062bbe55a1f6d77b89d07135ba3b09f97bfac1cb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/38de2979d90d8cd94f18e0567be4c8342d0e0410",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}