CVE-2026-64014

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

nexio_read_data() pulls data_len and x_len from a packed __be16 header

in the device's interrupt packet and then walks packet->data[0..x_len)

and packet->data[x_len..data_len) comparing each byte against a

threshold.

Both fields are 16-bit on the wire (max 65535). The existing

adjustments shave at most 0x100 / 0x80 off, so the loop bound can still

reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size

(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the

packed header — so packet->data[] has 1017 valid bytes. read_data()

callbacks are not given urb->actual_length, and nothing else bounds the

walk.

A device that lies about its length can get a ~64 KiB out-of-bounds read

past the coherent DMA allocation. The first index whose byte exceeds

NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the

reporte

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References