CVE-2026-64014 (GCVE-0-2026-64014)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-07-19 14:56
VLAI
Title
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < 45c829e5eb3b974282bae50b7cca2cc891f74f0b (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < 95f47331dfde243f93e679ce70bd0c24b37c683d (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < d883312061ccde8c536595998aaf687ec070077c (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < 103d2de9f505f56da173e43f12dba62f92620278 (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < 0ca809ea8e0355299266c46e5f1755040aa8dcf3 (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < 7585b6aa55d8ac85ad22f522e1059f93507727b6 (git)
Affected: 5197424cdcccd2b0b1922babb93969b2515c43ce , < 2905281cbda52ec9df540113b35b835feb5fafd3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/touchscreen/usbtouchscreen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45c829e5eb3b974282bae50b7cca2cc891f74f0b",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "95f47331dfde243f93e679ce70bd0c24b37c683d",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "d883312061ccde8c536595998aaf687ec070077c",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "103d2de9f505f56da173e43f12dba62f92620278",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "0ca809ea8e0355299266c46e5f1755040aa8dcf3",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "7585b6aa55d8ac85ad22f522e1059f93507727b6",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            },
            {
              "lessThan": "2905281cbda52ec9df540113b35b835feb5fafd3",
              "status": "affected",
              "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/touchscreen/usbtouchscreen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n\nnexio_read_data() pulls data_len and x_len from a packed __be16 header\nin the device\u0027s interrupt packet and then walks packet-\u003edata[0..x_len)\nand packet-\u003edata[x_len..data_len) comparing each byte against a\nthreshold.\n\nBoth fields are 16-bit on the wire (max 65535).  The existing\nadjustments shave at most 0x100 / 0x80 off, so the loop bound can still\nreach roughly 0xfeff.  The URB transfer buffer for NEXIO is rept_size\n(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the\npacked header \u2014 so packet-\u003edata[] has 1017 valid bytes.  read_data()\ncallbacks are not given urb-\u003eactual_length, and nothing else bounds the\nwalk.\n\nA device that lies about its length can get a ~64 KiB out-of-bounds read\npast the coherent DMA allocation.  The first index whose byte exceeds\nNEXIO_THRESHOLD lands in begin_x / begin_y and from there into the\nreported touch coordinates, so adjacent kernel memory contents leak to\nuserspace as ABS_X / ABS_Y events.  Far enough out, the read can also\nhit an unmapped page and fault.\n\nFix this all by clamping data_len to the buffer\u0027s data[] capacity and\nx_len to data_len."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:56:27.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb"
        },
        {
          "url": "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c"
        },
        {
          "url": "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3"
        }
      ],
      "title": "Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64014",
    "datePublished": "2026-07-19T14:56:27.995Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-07-19T14:56:27.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64014",
      "date": "2026-09-21",
      "epss": "0.00177",
      "percentile": "0.07458"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/input/touchscreen/usbtouchscreen.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "45c829e5eb3b974282bae50b7cca2cc891f74f0b",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95f47331dfde243f93e679ce70bd0c24b37c683d",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d883312061ccde8c536595998aaf687ec070077c",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "103d2de9f505f56da173e43f12dba62f92620278",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ca809ea8e0355299266c46e5f1755040aa8dcf3",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7585b6aa55d8ac85ad22f522e1059f93507727b6",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2905281cbda52ec9df540113b35b835feb5fafd3",
                    "status": "affected",
                    "version": "5197424cdcccd2b0b1922babb93969b2515c43ce",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/input/touchscreen/usbtouchscreen.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.34"
                  },
                  {
                    "lessThan": "2.6.34",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n\nnexio_read_data() pulls data_len and x_len from a packed __be16 header\nin the device\u0027s interrupt packet and then walks packet-\u003edata[0..x_len)\nand packet-\u003edata[x_len..data_len) comparing each byte against a\nthreshold.\n\nBoth fields are 16-bit on the wire (max 65535).  The existing\nadjustments shave at most 0x100 / 0x80 off, so the loop bound can still\nreach roughly 0xfeff.  The URB transfer buffer for NEXIO is rept_size\n(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the\npacked header \u2014 so packet-\u003edata[] has 1017 valid bytes.  read_data()\ncallbacks are not given urb-\u003eactual_length, and nothing else bounds the\nwalk.\n\nA device that lies about its length can get a ~64 KiB out-of-bounds read\npast the coherent DMA allocation.  The first index whose byte exceeds\nNEXIO_THRESHOLD lands in begin_x / begin_y and from there into the\nreported touch coordinates, so adjacent kernel memory contents leak to\nuserspace as ABS_X / ABS_Y events.  Far enough out, the read can also\nhit an unmapped page and fault.\n\nFix this all by clamping data_len to the buffer\u0027s data[] capacity and\nx_len to data_len."
          }
        ],
        "id": "CVE-2026-64014",
        "lastModified": "2026-07-30T14:59:47.950",
        "metrics": {},
        "published": "2026-07-19T16:17:41.320",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T00:30:36+00:00",
      "cve": "CVE-2026-64014",
      "id": "CVE-2026-64014",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64014.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:44:44Z",
      "cve": "CVE-2026-64014",
      "id": "CVE-2026-64014",
      "initial_release_date": "2026-07-21T13:01:32Z",
      "product_status:known_affected": "675",
      "product_status:known_not_affected": "58",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64014",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64014.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.