UnratedFix available

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len.

Products: Kernel
Affected versions: Not specified
Fixed versions: 5.10.259, 5.15.210, 6.1.176, 6.12.93, 6.18.35, 6.6.143, 7.0.12
CVEs: CVE-2026-64014
Confirmed fixed CVEs: Not specified
Updated in this feed: 3 Nov 2026, 15:17 UTC · Revision 1

Source evidence

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

core-osv · Original source

Published 19 Jul 2026, 14:56 UTC

osv:CVE-2026-64014

Kernel

Fixed versions: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12

Complete source record

{
  "id": "a3cee7c70553d0b556314a45a4c60672421c67c7bed15fc001897b3773af1e69",
  "url": "https://osv.dev/vulnerability/CVE-2026-64014",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len.",
    "evidence": "osv:CVE-2026-64014",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.259",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.210",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.176",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.143",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.93",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.35",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.12",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-64014",
      "aliases": [
        "CVE-2026-64014"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5197424cdcccd2b0b1922babb93969b2515c43ce"
                },
                {
                  "fixed": "45c829e5eb3b974282bae50b7cca2cc891f74f0b"
                },
                {
                  "fixed": "e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb"
                },
                {
                  "fixed": "95f47331dfde243f93e679ce70bd0c24b37c683d"
                },
                {
                  "fixed": "d883312061ccde8c536595998aaf687ec070077c"
                },
                {
                  "fixed": "103d2de9f505f56da173e43f12dba62f92620278"
                },
                {
                  "fixed": "0ca809ea8e0355299266c46e5f1755040aa8dcf3"
                },
                {
                  "fixed": "7585b6aa55d8ac85ad22f522e1059f93507727b6"
                },
                {
                  "fixed": "2905281cbda52ec9df540113b35b835feb5fafd3"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64014.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.34"
                },
                {
                  "fixed": "5.10.259"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.210"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.176"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.143"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.93"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.35"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.0.12"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64014.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.627941965Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3",
        "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278",
        "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3",
        "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b",
        "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6",
        "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d",
        "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c",
        "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64014.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-64014",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64014.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-64014",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 496740,
  "published_at": "2026-07-19T14:56:27.995+00:00"
}