Out-of-bounds write in Linux kernel - CVE-2026-64364

Vulnerability details

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the HID multitouch driver when processing input from a crafted USB or Bluetooth HID multitouch device that advertises a large contact count. An attacker with physical access can provide a crafted device to corrupt adjacent members of struct mt_device and cause a denial of service.

The issue is reachable from an untrusted USB or Bluetooth HID multitouch device, and the kernel panic can be triggered from timer context through the sticky-fingers release path.

Affected software

How to mitigate CVE-2026-64364

External References

• https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55
• https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75
• https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d
• https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22
• https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be
• https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d
• https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8
• https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4

Related Security Bulletins

• Out-of-bounds write in Linux kernel hid driver
• Debian update for linux