Out-of-Bounds Read Vulnerability in Linux Kernel Affecting NEXIO Touchscreen Devices

CVE-2026-64014

What is CVE-2026-64014?

The vulnerability identified in the Linux kernel impacts NEXIO touchscreen devices by allowing an out-of-bounds read due to insufficient validation of input lengths. When the 'nexio_read_data()' function processes data from a device's interrupt packet, it fails to properly enforce bounds on the 'data_len' and 'x_len' values drawn from a packed header. This can allow an attacker to exploit a device that reports misleading length values, potentially causing the extraction of sensitive adjacent kernel memory information. This leak occurs as the kernel attempts to report touch coordinates to user space, exposing them to unauthorized access. The fix implements strict limitations on 'data_len' and 'x_len' to ensure they do not exceed the buffer's capacity, thereby mitigating the risk of such leaks.

References