CVE-2026-64014: In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len
Summary
A vulnerability in the Linux kernel's USB touchscreen driver allows a malicious device to read up to 64 KB of data beyond the allocated buffer by claiming false packet lengths. This out-of-bounds read (accessing memory outside intended boundaries) can leak adjacent kernel memory contents to userspace through touch coordinate events, or cause the system to crash by accessing unmapped memory.
Solution / Mitigation
Clamp data_len to the buffer's data[] capacity and x_len to data_len. This fix ensures the loop bounds stay within the valid 1017 bytes of packet data, preventing out-of-bounds access.
Vulnerability Details
EPSS: 0.0%
July 19, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-64014
First tracked: July 19, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 95%