CVE-2026-64014

{"id": "CVE-2026-64014", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "45c829e5eb3b974282bae50b7cca2cc891f74f0b", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "95f47331dfde243f93e679ce70bd0c24b37c683d", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "d883312061ccde8c536595998aaf687ec070077c", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "103d2de9f505f56da173e43f12dba62f92620278", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "0ca809ea8e0355299266c46e5f1755040aa8dcf3", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "7585b6aa55d8ac85ad22f522e1059f93507727b6", "versionType": "git"}, {"status": "affected", "version": "5197424cdcccd2b0b1922babb93969b2515c43ce", "lessThan": "2905281cbda52ec9df540113b35b835feb5fafd3", "versionType": "git"}], "programFiles": ["drivers/input/touchscreen/usbtouchscreen.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.34"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.34", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/input/touchscreen/usbtouchscreen.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T16:17:41.320", "references": [{"url": "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n\nnexio_read_data() pulls data_len and x_len from a packed __be16 header\nin the device's interrupt packet and then walks packet->data[0..x_len)\nand packet->data[x_len..data_len) comparing each byte against a\nthreshold.\n\nBoth fields are 16-bit on the wire (max 65535). The existing\nadjustments shave at most 0x100 / 0x80 off, so the loop bound can still\nreach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size\n(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the\npacked header \u2014 so packet->data[] has 1017 valid bytes. read_data()\ncallbacks are not given urb->actual_length, and nothing else bounds the\nwalk.\n\nA device that lies about its length can get a ~64 KiB out-of-bounds read\npast the coherent DMA allocation. The first index whose byte exceeds\nNEXIO_THRESHOLD lands in begin_x / begin_y and from there into the\nreported touch coordinates, so adjacent kernel memory contents leak to\nuserspace as ABS_X / ABS_Y events. Far enough out, the read can also\nhit an unmapped page and fault.\n\nFix this all by clamping data_len to the buffer's data[] capacity and\nx_len to data_len."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEntrada: usbtouchscreen - limitar NEXIO data_len/x_len al tama\u00f1o del b\u00fafer URB\n\nnexio_read_data() extrae data_len y x_len de una cabecera __be16 empaquetada en el paquete de interrupci\u00f3n del dispositivo y luego recorre packet -> data[0..x_len) y packet -> data[x_len..data_len) comparando cada byte con un umbral.\n\nAmbos campos son de 16 bits en el cable (m\u00e1x. 65535). Los ajustes existentes recortan como m\u00e1ximo 0x100 / 0x80, por lo que el l\u00edmite del bucle a\u00fan puede alcanzar aproximadamente 0xfeff. El b\u00fafer de transferencia URB para NEXIO es de rept_size (1024) bytes de usb_alloc_coherent(), con los primeros 7 ocupados por la cabecera empaquetada - por lo que packet -> data[] tiene 1017 bytes v\u00e1lidos. Las devoluciones de llamada de read_data() no reciben urb -> actual_length, y nada m\u00e1s limita el recorrido.\n\nUn dispositivo que miente sobre su longitud puede obtener una lectura fuera de l\u00edmites de ~64 KiB m\u00e1s all\u00e1 de la asignaci\u00f3n DMA coherente. El primer \u00edndice cuyo byte excede NEXIO_THRESHOLD aterriza en begin_x / begin_y y de ah\u00ed a las coordenadas t\u00e1ctiles reportadas, por lo que el contenido adyacente de la memoria del kernel se filtra al espacio de usuario como eventos ABS_X / ABS_Y. Lo suficientemente lejos, la lectura tambi\u00e9n puede alcanzar una p\u00e1gina no mapeada y causar un fallo.\n\nSolucione todo esto limitando data_len a la capacidad data[] del b\u00fafer y x_len a data_len."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EFA81C6-11F5-426B-A795-3F05B59387EE", "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}