CVE-2026-64270 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: mms114 - reject an oversized device packet size
mms114_interrupt() reads a packet of touch data from the device into a fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes, i.e. 80 bytes. The length of the I2C read into it is taken verbatim from the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE); if (packet_size <= 0) goto out; ... error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size, (u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check is the lower bound packet_size <= 0; it is never bounded against the size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject an oversized packet and drop the report, consistent with the handler's other error paths, rather than reading past the buffer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question involves a critical buffer overflow flaw within the Linux kernel's mms114 touchscreen driver implementation. This issue affects the mms114_interrupt() function which handles touch data processing from MMS114 touchscreen controllers through I2C communication. The driver allocates a fixed-size on-stack buffer named touch[] that can accommodate exactly 10 touch events of 8 bytes each, totaling 80 bytes of memory allocation. This specific buffer design represents a classic stack-based buffer overflow vulnerability where the system fails to validate input data against allocated buffer boundaries.
The technical flaw stems from the driver's failure to implement proper bounds checking on the packet size parameter retrieved from the device register. The function reads a single byte value from the MMS114_PACKET_SIZE register at address 0x0F and directly uses this unvalidated value as the length parameter for the I2C read operation. The only validation performed is a simple check that packet_size must be greater than zero, with no upper boundary enforcement against the actual buffer capacity of 80 bytes. This allows an attacker or malfunctioning device to submit a packet size value up to 255 bytes, which when processed by __mms114_read_reg() results in writing data far beyond the allocated buffer boundaries.
The operational impact of this vulnerability is severe and directly relates to the fundamental security principles of memory safety. When an oversized packet is received, the system performs a stack out-of-bounds write operation that can overwrite critical stack metadata including the stack canary value, saved processor registers, and ultimately the return address of the interrupted function. This type of memory corruption creates a potential exploitation vector that aligns with CWE-121 Stack-based Buffer Overflow and represents a direct violation of the principle of least privilege. The attack surface is particularly concerning because it operates within the kernel context during interrupt handling, which typically executes with elevated privileges and can lead to complete system compromise.
The vulnerability demonstrates poor defensive programming practices and inadequate input validation mechanisms that are fundamental requirements in secure system design. According to ATT&CK framework category T1068, this represents a privilege escalation opportunity through kernel memory corruption, while the specific technique aligns with T1547.001 for kernel-level attack surface exploitation. The recommended mitigation strategy involves implementing proper bounds checking before any data processing occurs, specifically rejecting packet sizes that exceed the buffer capacity rather than allowing potentially malicious or malformed data to overwrite system memory. This approach ensures consistency with existing error handling patterns within the same function and prevents the exploitation of the stack-based overflow through simple input validation controls.
The solution requires modifying the mms114_interrupt() function to validate that packet_size does not exceed MMS114_MAX_TOUCH * MMS114_EVENT_SIZE before proceeding with the I2C read operation. This validation ensures that the device cannot force a buffer overflow condition by reporting an oversized packet size, thereby maintaining system integrity and preventing potential privilege escalation attacks. The fix should be consistent with existing error handling within the driver codebase and maintain the principle of rejecting malformed input rather than attempting to process it beyond allocated boundaries.