Out-of-Bounds Read Vulnerability in Linux Kernel Affecting elan_i2c Driver

CVE-2026-64237

What is CVE-2026-64237?

A vulnerability has been identified in the elan_i2c driver of the Linux kernel where insufficient validation of firmware size could allow for out-of-bounds reads. This issue occurs when the firmware file is accessed without ensuring its size is adequate to accommodate the expected number of pages and the signature located at the end of the firmware blob. Exploiting this vulnerability may lead to potential system instability or unauthorized access to sensitive information.

References