Executive brief
A security vulnerability exists in the Linux kernel driver for MELFAS mms114 touchscreen controllers. A malicious or compromised hardware device connected to the system could send an oversized data packet that overflows the system's memory. This could lead to a complete system crash or allow an attacker to gain unauthorized control over the operating system.
Technical details
A stack-based buffer overflow exists in the mms114_interrupt() function within drivers/input/touchscreen/mms114.c. The driver reads a packet size value directly from the I2C device register (MMS114_PACKET_SIZE) and uses it as the length for a subsequent read into a fixed-size stack buffer (struct mms114_touch touch[10]) without validation. An attacker with physical access to the I2C bus or a compromised controller can provide a packet size up to 255 bytes, exceeding the 80-byte buffer and overwriting the stack canary, saved registers, and return addresses. The vulnerability has been patched by adding a check to reject packets larger than the destination buffer.
Affected products
- Linux Linux Kernel 3.6 to 6.6.145
Timeline
- 2026-06-14: other: Vulnerability fixed in source code by Bryam Vargas
- 2026-07-25: advisory: CVE-2026-64270 published
References
- https://git.kernel.org/stable/c/5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6
- https://git.kernel.org/stable/c/66725039f7090afe14c31bd259e2059a68f04023
- https://git.kernel.org/stable/c/8301c335305344d4da4ab9442b6a399dacfe5b8d
- https://git.kernel.org/stable/c/b78150729762d47c14fe29a2582bdca5568e62b8
- https://git.kernel.org/stable/c/f3d5e77b27fded71dcb97f409262bf0abba0410e