CVE-2026-64364

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: fix out-of-bounds bit access on mt_io_flags

mt_io_flags is a single unsigned long, but mt_process_slot(),

mt_release_pending_palms() and mt_release_contacts() use it as a

per-slot bitmap indexed by the slot number. That slot number is only

bounded by td->maxcontacts, which is taken from the device's

ContactCountMaximum feature report and can be up to 255, not by

BITS_PER_LONG.

As a result, a multitouch device that advertises a large contact count

makes set_bit()/clear_bit() operate past the mt_io_flags word and

corrupt the adjacent members of struct mt_device. The sticky-fingers

release timer is the easiest way to reach this. mt_release_contacts()

runs

for (i = 0; i < mt->num_slots; i++)

clear_bit(i, &td->mt_io_flags);

with num_slots == maxcontacts. For maxcontacts around 250 the loop

clears the bits that overlap td->applications.next, zeroing that list

head, and the list_for_each_entry() that

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References