CVE-2026-64014
Publication date 20 July 2026
Last updated 9 October 2026
Ubuntu priority
Description
In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len.
Patch details
| Package | Patch details |
|---|
References
Related Ubuntu Security Notices (USN)
- USN-8593-1
- Linux kernel vulnerabilities
- 23 July 2026
- USN-8603-1
- Linux kernel (Azure) vulnerabilities
- 24 July 2026
- USN-8618-1
- Linux kernel vulnerabilities
- 28 July 2026
- USN-8663-1
- Linux kernel (NVIDIA) vulnerabilities
- 20 August 2026
- USN-8664-1
- Linux kernel (NVIDIA BaseOS) vulnerabilities
- 20 August 2026
- USN-8728-1
- Linux kernel (GCP) vulnerabilities
- 7 September 2026
- USN-8728-2
- Linux kernel (Azure) vulnerabilities
- 22 September 2026
- USN-8728-3
- Linux kernel (Oracle) vulnerabilities
- 29 September 2026
- USN-8878-1
- Linux kernel (GCP) vulnerabilities
- 6 October 2026
- USN-8879-1
- Linux kernel (Oracle) vulnerabilities
- 6 October 2026
- USN-8877-1
- Linux kernel (GCP) vulnerabilities
- 6 October 2026
- USN-8875-1
- Linux kernel vulnerabilities
- 6 October 2026
- USN-8903-1
- Linux kernel vulnerabilities
- 8 October 2026
- USN-8906-1
- Linux kernel (IBM) vulnerabilities
- 8 October 2026
- USN-8905-1
- Linux kernel (GCP) vulnerabilities
- 8 October 2026
- USN-8904-1
- Linux kernel (Azure) vulnerabilities
- 8 October 2026
- USN-8903-2
- Linux kernel vulnerabilities
- 9 October 2026
- USN-8875-2
- Linux kernel (NVIDIA) vulnerabilities
- 9 October 2026
- USN-8905-2
- Linux kernel (GCP) vulnerabilities
- 9 October 2026