CVE-2026-64272 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: mms114 - fix touch indexing for MMS134S and MMS136
The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When __mms114_read_reg() reads the touch data packet from the device into the touch buffer, the events are packed tightly at 6-byte intervals. However, the driver iterates through the events using standard C array indexing (touch[index]), where each
element is sizeof(struct mms114_touch) (8 bytes) apart. As a result, any touch events beyond the first one are read from incorrect offsets and parsed improperly.
Fix this by explicitly calculating the byte offset for each touch event based on the device's specific event size.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in the Linux kernel's mms114 driver affects touch controllers including the MMS134S and MMS136 models, where a fundamental mismatch exists between expected and actual data packet structures. This issue stems from the driver's assumption that all touch events follow a consistent 8-byte structure while these specific controllers actually transmit data in 6-byte packets. The discrepancy creates a critical parsing error that fundamentally undermines the integrity of touch input processing.
The technical flaw manifests in how the driver handles memory access patterns during data retrieval from hardware devices. When __mms114_read_reg() function reads touch data from the MMS134S and MMS136 controllers, it populates a buffer with tightly packed 6-byte event structures. However, the subsequent parsing logic employs standard C array indexing that assumes 8-byte spacing between elements, creating an off-by-two-byte offset error in memory access patterns. This fundamental mismatch causes all touch events beyond the initial one to be read from incorrect memory locations, resulting in corrupted data interpretation and malformed touch coordinates.
The operational impact of this vulnerability extends beyond simple input errors to potentially compromise user interaction reliability across affected devices. Mobile devices, tablets, and other touchscreen systems utilizing these controllers may experience intermittent touch failures, phantom touches, or completely unusable touch interfaces. The issue affects the core input handling mechanism within the Linux kernel's input subsystem, making it a critical concern for device stability and user experience. This vulnerability represents a classic buffer overread condition that could potentially be exploited to inject malformed data into the system's input processing pipeline.
The fix implemented addresses the root cause by introducing explicit byte offset calculations based on the device-specific event size rather than relying on generic array indexing assumptions. This approach aligns with established cybersecurity principles of defensive programming and proper memory management practices. The solution ensures that each touch event is correctly positioned within the data buffer regardless of the underlying hardware's specific packet structure, thereby eliminating the parsing errors that led to incorrect touch coordinates.
This vulnerability demonstrates characteristics consistent with CWE-129, which addresses improper validation of array indices, and relates to ATT&CK technique T1059.001 for input validation failures in kernel space. The fix reinforces proper bounds checking mechanisms and memory access controls that prevent unauthorized data manipulation through input processing pathways. The resolution maintains backward compatibility while establishing a more robust framework for handling varying hardware specifications within the same driver architecture, adhering to industry standards for embedded system security and device driver development practices.