Executive brief
A vulnerability in the Elan I2C touchpad driver for the Linux kernel can cause a system crash (kernel panic) if the hardware provides invalid configuration data. This occurs when the system attempts to calculate the touchpad's resolution using zero values provided by the device firmware. Additionally, a separate logic error could cause the system to report incorrect touch data to applications, potentially affecting the usability of the device.
Technical details
A vulnerability exists in the elan_i2c driver within the Linux kernel's input subsystem. The driver fails to validate 'x_traces' and 'y_traces' values retrieved from device firmware or the device tree before using them as divisors in resolution calculations, leading to a division-by-zero kernel panic during device probe. Furthermore, an arithmetic underflow occurs in the touch reporting logic when the calculated width is less than the ETP_FWIDTH_REDUCE constant (90), resulting in large unsigned integer values being passed to userspace. The fix introduces non-zero checks with safe fallbacks and clamps adjusted width values to zero to prevent underflow. Patching ensures the device probe completes, allowing for firmware recovery via sysfs if the hardware was in a bad state.
Affected products
- Linux Linux Kernel 6696777c6506fa52b2a0282121195843ed855be6 to 59d4cc5e7a9785e4bdc9c55273274c6b49d4b58d
Timeline
- 2026-06-22: other: Vulnerability fixed in kernel source
- 2026-07-25: disclosed: CVE-2026-64275 published
References
- https://git.kernel.org/stable/c/01e0317c256c560d8dcce2e9825eb6142ee34611
- https://git.kernel.org/stable/c/2f281ff0163a38fdc4cb4061f0c241e643283a5e
- https://git.kernel.org/stable/c/59d4cc5e7a9785e4bdc9c55273274c6b49d4b58d
- https://git.kernel.org/stable/c/6bac57d8fe2a077b8a85b4140eeb7999078158eb
- https://git.kernel.org/stable/c/8c1db3418a419e788691746b9c47f863c2fd4890
- https://git.kernel.org/stable/c/df2b818fa009c10ff6ba875a1663ff001cda9558
- https://git.kernel.org/stable/c/f6d10af2036d1d4a847a74fe47ebbf93bce3c84c