CVE-2026-64014

A flaw was found in the Linux kernel's usbtouchscreen driver. A local attacker with a specially crafted USB touch screen device could exploit this vulnerability by sending a malicious interrupt packet with an oversized length field. This improper handling of input lengths can lead to an out-of-bounds read, allowing the attacker to leak sensitive kernel memory contents to userspace. In some scenarios, this could also result in a system crash.

An out of bounds read in the usbtouchscreen NEXIO parser occurs because data_len and x_len are taken from a device supplied packet header and were not bounded by the URB buffer size. A malicious or compromised USB touchscreen can advertise a length much larger than the 1024 byte transfer buffer, making nexio_read_data scan beyond packet data while looking for threshold crossings. The first matching bytes can influence ABS_X and ABS_Y input events, so adjacent kernel memory may be exposed to local userspace through reported touch coordinates, and a farther read can fault and crash the kernel. For the CVSS the PR:N because the attacker does not need an account on the target when they can control the attached USB device. The issue is not network reachable in normal deployments. Impact is confidentiality loss and denial of service, with no supported integrity or privilege escalation primitive from this patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.