CVE-2026-64271 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: touchwin - reset the packet index on every complete packet
tw_interrupt() accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received *and* the device's two Y bytes agree:
tw->data[tw->idx++] = data;
if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
... tw->idx = 0; }
The reset is gated on tw->data[1] == tw->data[2], a value the device
controls. A malicious, malfunctioning or counterfeit Touchwindow peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the index reaches TW_LENGTH without the equality holding, is never reset, and keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen byte at a time -- an unbounded, device-driven heap out-of-bounds write.
Reset the index on every completed packet and report an event only when the two Y bytes match, like the other serio touchscreen drivers do.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists in the linux kernel's touchwindow serial input driver implementation where a critical flaw in the interrupt handling routine creates an exploitable heap buffer overflow condition. The tw_interrupt() function processes incoming serial data from touchwindow peripherals by accumulating non-zero bytes into a fixed three-byte buffer using a running index counter that only resets when both Y coordinate bytes match. This design creates a fundamental race condition where malicious or faulty hardware can manipulate the packet structure to prevent the index reset mechanism from activating, allowing continuous buffer overflow beyond its allocated boundaries.
The technical flaw stems from improper boundary checking in the packet processing logic where the index reset occurs only when tw->data[1] equals tw->data[2], a condition entirely controlled by the peripheral device. When this equality fails to occur within the TW_LENGTH buffer size, the index continues incrementing beyond the three-byte allocation, eventually writing attacker-controlled data into adjacent heap memory locations. This unbounded heap overflow represents a severe memory corruption vulnerability that can be exploited to overwrite critical kernel structures and potentially achieve arbitrary code execution.
The operational impact of this vulnerability is significant as it allows for device-driven heap corruption without requiring any special privileges or complex attack vectors. The flaw affects all systems using touchwindow peripherals where the device driver processes serial input from these specific hardware components, making it a widespread concern across various linux kernel versions and embedded systems. The vulnerability operates at the kernel level with potential for privilege escalation, system instability, and denial of service conditions that could affect critical infrastructure or consumer devices.
This vulnerability aligns with CWE-121 heap-based buffer overflow and represents a classic example of unsafe memory access patterns in kernel drivers. The flaw demonstrates poor defensive programming practices where device-controlled inputs are not properly validated before being used in memory operations. From an ATT&CK perspective, this maps to privilege escalation techniques through kernel exploitation and can be categorized under T1068 legitimate credentials and system compromise. The recommended mitigation involves modifying the driver logic to reset the packet index on every completed packet regardless of Y byte equality, following established patterns used by other serio touchscreen drivers in the kernel ecosystem.
The fix implementation requires changing the conditional reset logic from dependent on device-controlled byte equality to unconditional reset upon packet completion. This approach aligns with secure coding practices that minimize trust in external inputs and ensure proper resource management even under adversarial conditions. The solution addresses the root cause by decoupling the index reset mechanism from device behavior, preventing the attacker-controlled overflow condition while maintaining functional correctness for legitimate devices. This remediation follows best practices for kernel driver security and aligns with the principle of least privilege in system design, ensuring that device inputs cannot corrupt kernel memory structures through simple protocol manipulation.