Executive brief
A vulnerability in the Linux kernel's touchscreen driver for MMS114-based controllers could lead to improper processing of touch events. On specific hardware models (MMS134S and MMS136), the system miscalculates the size of data packets sent by the screen, causing it to read touch information from the wrong memory locations. This could result in erratic system behavior or potential stability issues when multiple touch points are active.
Technical details
A logic error exists in the mms114 touchscreen driver (drivers/input/touchscreen/mms114.c) regarding how it handles event packets from MMS134S and MMS136 controllers. These specific models use a 6-byte event size, but the driver was iterating through the touch buffer using standard C array indexing based on 'struct mms114_touch', which is 8 bytes. This results in an out-of-bounds read relative to the intended event structure for any touch event beyond the first one in a packet. An attacker with physical access to the touchscreen could potentially trigger improper memory parsing. The fix involves explicitly calculating byte offsets based on the device-specific event size.
Affected products
- Linux Linux Kernel 5.13 to 7.1.4
Timeline
- 2026-07-25: disclosed: CVE published by kernel.org
- 2026-07-25: patched: Fixes merged into stable branches
References
- https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a
- https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981
- https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21
- https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d
- https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977