Executive brief
A vulnerability was identified in the Linux kernel's Atmel maXTouch touchscreen driver. The software incorrectly handles configuration files that are larger than expected, leading to a one-byte memory overwrite. This could potentially lead to system instability or unpredictable behavior on devices using these specific touchscreen controllers.
Technical details
An off-by-one error exists in the 'atmel_mxt_ts' driver within the 'mxt_prepare_cfg_mem' function. When processing a configuration file where an object size exceeds the driver's known 'mxt_obj_size', a loop using a 0-based index 'i' incorrectly evaluates the boundary condition 'if (i > mxt_obj_size(object))'. Because the valid index range is 0 to size-1, the condition fails when 'i' equals 'mxt_obj_size', causing the driver to write one extra byte to a calculated 'byte_offset'. This results in a single-byte overwrite of adjacent memory instances or objects. The issue is resolved by updating the boundary check to use the '>=' operator.
Affected products
- Linux Linux Kernel 50a77c658b80 to 862a1a32b519
Timeline
- 2026-05-04: other: Patch authored
- 2026-06-19: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1017e1c6c6c49cccbcda9bbcfa49e50b0b6dad39
- https://git.kernel.org/stable/c/5c3681c3abc35cfac6b702251382312c60d96bc2
- https://git.kernel.org/stable/c/6c6b989b4ebf22b086fdfcac2163b5cb55e34d8f
- https://git.kernel.org/stable/c/7f95f4792c0dc767fcb8e405391e779ab419d55a
- https://git.kernel.org/stable/c/862a1a32b5190241fce7a7d20229539a3926f31e
- https://git.kernel.org/stable/c/ae92e334544263a02d9f99e18385e718c44392c9
- https://git.kernel.org/stable/c/baa0210fb6a9dc3882509a9411b6d284d88fe30e