Vulnerability-Lookup

CVE-2026-64364 (GCVE-0-2026-64364)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-07-27 04:59

Title

HID: multitouch: fix out-of-bounds bit access on mt_io_flags

Summary

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG. As a result, a multitouch device that advertises a large contact count makes set_bit()/clear_bit() operate past the mt_io_flags word and corrupt the adjacent members of struct mt_device. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs for (i = 0; i < mt->num_slots; i++) clear_bit(i, &td->mt_io_flags); with num_slots == maxcontacts. For maxcontacts around 250 the loop clears the bits that overlap td->applications.next, zeroing that list head, and the list_for_each_entry() that immediately follows then dereferences NULL. The kernel panics from timer (softirq) context. On a KASAN build this shows up as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, which is offsetof(struct mt_application, num_received). The state is reachable from an untrusted USB or Bluetooth HID multitouch device; no local privileges are required. Store the per-slot active state in a separately allocated bitmap sized for maxcontacts, the same pattern already used for pending_palm_slots, and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two "mt_io_flags & MT_IO_SLOTS_MASK" arming checks become bitmap_empty(td->active_slots, td->maxcontacts). Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the same commit to leave the low byte for the slot bits; with the slot bits gone it fits in bit 0 again, which also keeps it within the unsigned long on 32-bit.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/12e90656e330ff8bb…
https://git.kernel.org/stable/c/152983d87387f6a8a…
https://git.kernel.org/stable/c/b5c037d6b807017e7…
https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf18…
https://git.kernel.org/stable/c/e24918ee67c4dc3d2…
https://git.kernel.org/stable/c/37daa8c96bd563d03…
https://git.kernel.org/stable/c/6493ebf9489efef01…
https://git.kernel.org/stable/c/8813b0612275cc61f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fc488f675344931ffab6a51c43691065ec006567 , < 12e90656e330ff8bbaf2f29c535fdb8a11cc6f55 (git) Affected: 77711d850bed75ae7142c3d1f22c1a8b4d049c33 , < 152983d87387f6a8ae72b73474cfa55fbcf1ec75 (git) Affected: 6acfe25968913788d30ec0eedd80178c4ea3f1d0 , < b5c037d6b807017e74a115288f81bc9cd5a5aab8 (git) Affected: d280c138e66be87d1fccfed42593f02fdb893905 , < a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d (git) Affected: f32fea4c0234c971c12e46d76612cdc2dd4bb046 , < e24918ee67c4dc3d20d4670750e46e9b160365f4 (git) Affected: 46f781e0d151844589dc2125c8cce3300546f92a , < 37daa8c96bd563d03150e23f094cb60703594a6d (git) Affected: 46f781e0d151844589dc2125c8cce3300546f92a , < 6493ebf9489efef0105078377b973ab33d51af22 (git) Affected: 46f781e0d151844589dc2125c8cce3300546f92a , < 8813b0612275cc61fe9e6603d0ee019247ade6be (git) Affected: 59bd04163e6451b9c7275277882ed9f4abfa2051 (git) Affected: 5.10.246 , < 5.10.261 (semver) Affected: 5.15.196 , < 5.15.212 (semver) Affected: 6.1.158 , < 6.1.178 (semver) Affected: 6.6.114 , < 6.6.145 (semver) Affected: 6.12.55 , < 6.12.97 (semver) Affected: 6.17.5 , < 6.18 (semver)
Linux	Linux	Affected: 6.18 Unaffected: 0 , < 6.18 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
              "status": "affected",
              "version": "fc488f675344931ffab6a51c43691065ec006567",
              "versionType": "git"
            },
            {
              "lessThan": "152983d87387f6a8ae72b73474cfa55fbcf1ec75",
              "status": "affected",
              "version": "77711d850bed75ae7142c3d1f22c1a8b4d049c33",
              "versionType": "git"
            },
            {
              "lessThan": "b5c037d6b807017e74a115288f81bc9cd5a5aab8",
              "status": "affected",
              "version": "6acfe25968913788d30ec0eedd80178c4ea3f1d0",
              "versionType": "git"
            },
            {
              "lessThan": "a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
              "status": "affected",
              "version": "d280c138e66be87d1fccfed42593f02fdb893905",
              "versionType": "git"
            },
            {
              "lessThan": "e24918ee67c4dc3d20d4670750e46e9b160365f4",
              "status": "affected",
              "version": "f32fea4c0234c971c12e46d76612cdc2dd4bb046",
              "versionType": "git"
            },
            {
              "lessThan": "37daa8c96bd563d03150e23f094cb60703594a6d",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "lessThan": "6493ebf9489efef0105078377b973ab33d51af22",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "lessThan": "8813b0612275cc61fe9e6603d0ee019247ade6be",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "59bd04163e6451b9c7275277882ed9f4abfa2051",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.246",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.196",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.158",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T04:59:56.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55"
        },
        {
          "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22"
        },
        {
          "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be"
        }
      ],
      "title": "HID: multitouch: fix out-of-bounds bit access on mt_io_flags",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64364",
    "datePublished": "2026-07-25T08:50:19.441Z",
    "dateReserved": "2026-07-19T15:36:31.783Z",
    "dateUpdated": "2026-07-27T04:59:56.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64364",
      "date": "2026-07-26",
      "epss": "0.00211",
      "percentile": "0.11452"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64364\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:19.110\",\"lastModified\":\"2026-07-27T05:16:43.347\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\\n\\nmt_io_flags is a single unsigned long, but mt_process_slot(),\\nmt_release_pending_palms() and mt_release_contacts() use it as a\\nper-slot bitmap indexed by the slot number. That slot number is only\\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\\nContactCountMaximum feature report and can be up to 255, not by\\nBITS_PER_LONG.\\n\\nAs a result, a multitouch device that advertises a large contact count\\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\\nrelease timer is the easiest way to reach this. mt_release_contacts()\\nruns\\n\\n\\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\\n\\t\\tclear_bit(i, \u0026td-\u003emt_io_flags);\\n\\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\\nhead, and the list_for_each_entry() that immediately follows then\\ndereferences NULL. The kernel panics from timer (softirq) context. On a\\nKASAN build this shows up as a general protection fault in\\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\\noffsetof(struct mt_application, num_received).\\n\\nThe state is reachable from an untrusted USB or Bluetooth HID\\nmultitouch device; no local privileges are required.\\n\\nStore the per-slot active state in a separately allocated bitmap sized\\nfor maxcontacts, the same pattern already used for pending_palm_slots,\\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\\n\\\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\\\" arming checks become\\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\\n\\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\\nsame commit to leave the low byte for the slot bits; with the slot bits\\ngone it fits in bit 0 again, which also keeps it within the unsigned\\nlong on 32-bit.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hid/hid-multitouch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fc488f675344931ffab6a51c43691065ec006567\",\"lessThan\":\"12e90656e330ff8bbaf2f29c535fdb8a11cc6f55\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77711d850bed75ae7142c3d1f22c1a8b4d049c33\",\"lessThan\":\"152983d87387f6a8ae72b73474cfa55fbcf1ec75\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6acfe25968913788d30ec0eedd80178c4ea3f1d0\",\"lessThan\":\"b5c037d6b807017e74a115288f81bc9cd5a5aab8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d280c138e66be87d1fccfed42593f02fdb893905\",\"lessThan\":\"a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f32fea4c0234c971c12e46d76612cdc2dd4bb046\",\"lessThan\":\"e24918ee67c4dc3d20d4670750e46e9b160365f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46f781e0d151844589dc2125c8cce3300546f92a\",\"lessThan\":\"37daa8c96bd563d03150e23f094cb60703594a6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46f781e0d151844589dc2125c8cce3300546f92a\",\"lessThan\":\"6493ebf9489efef0105078377b973ab33d51af22\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46f781e0d151844589dc2125c8cce3300546f92a\",\"lessThan\":\"8813b0612275cc61fe9e6603d0ee019247ade6be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"59bd04163e6451b9c7275277882ed9f4abfa2051\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.246\",\"lessThan\":\"5.10.261\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.196\",\"lessThan\":\"5.15.212\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.158\",\"lessThan\":\"6.1.178\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.114\",\"lessThan\":\"6.6.145\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.55\",\"lessThan\":\"6.12.97\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.17.5\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hid/hid-multitouch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T16:00:55Z",
      "cve": "CVE-2026-64364",
      "id": "CVE-2026-64364",
      "initial_release_date": "2026-07-25T16:00:55Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64364",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64364.json",
      "version": "2"
    }
  }
}

GHSA-9VQ4-GG6C-67HR

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: fix out-of-bounds bit access on mt_io_flags

mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG.

As a result, a multitouch device that advertises a large contact count makes set_bit()/clear_bit() operate past the mt_io_flags word and corrupt the adjacent members of struct mt_device. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs

for (i = 0; i < mt->num_slots; i++)
    clear_bit(i, &td->mt_io_flags);

with num_slots == maxcontacts. For maxcontacts around 250 the loop clears the bits that overlap td->applications.next, zeroing that list head, and the list_for_each_entry() that immediately follows then dereferences NULL. The kernel panics from timer (softirq) context. On a KASAN build this shows up as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, which is offsetof(struct mt_application, num_received).

The state is reachable from an untrusted USB or Bluetooth HID multitouch device; no local privileges are required.

Store the per-slot active state in a separately allocated bitmap sized for maxcontacts, the same pattern already used for pending_palm_slots, and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two "mt_io_flags & MT_IO_SLOTS_MASK" arming checks become bitmap_empty(td->active_slots, td->maxcontacts).

Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the same commit to leave the low byte for the slot bits; with the slot bits gone it fits in bit 0 again, which also keeps it within the unsigned long on 32-bit.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64364"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:19Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit.",
  "id": "GHSA-9vq4-gg6c-67hr",
  "modified": "2026-07-25T12:31:33Z",
  "published": "2026-07-25T12:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64364"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-64364 (GCVE-0-2026-64364)

GHSA-9VQ4-GG6C-67HR

Tags

Sightings

Nomenclature