Executive brief
A vulnerability in the Linux kernel's USB touchscreen driver could allow a malicious USB device to leak sensitive kernel memory. By providing a specially crafted response, a connected device can trick the system into reading data outside of the intended buffer. This could result in the exposure of private system information to a local user or cause a system crash.
Technical details
An out-of-bounds read vulnerability exists in the nexio_read_data() function within drivers/input/touchscreen/usbtouchscreen.c. The driver fails to validate the data_len and x_len fields provided in the device's interrupt packet header against the actual URB transfer buffer size (1024 bytes). A malicious USB device can specify lengths up to 65535, causing the driver to walk past the allocated DMA buffer. This results in a ~64 KiB out-of-bounds read where adjacent kernel memory contents are leaked to userspace as touch coordinate events (ABS_X/ABS_Y) or trigger a kernel panic if an unmapped page is accessed. The fix implements clamping of these length fields to the buffer's capacity.
Affected products
- Linux Linux 5197424cdccc to 45c829e5eb3b974282bae50b7cca2cc891f74f0b
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3
- https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278
- https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3
- https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b
- https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6
- https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d
- https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c