CVE-2026-64364 (GCVE-0-2026-64364)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
Title
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG. As a result, a multitouch device that advertises a large contact count makes set_bit()/clear_bit() operate past the mt_io_flags word and corrupt the adjacent members of struct mt_device. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs for (i = 0; i < mt->num_slots; i++) clear_bit(i, &td->mt_io_flags); with num_slots == maxcontacts. For maxcontacts around 250 the loop clears the bits that overlap td->applications.next, zeroing that list head, and the list_for_each_entry() that immediately follows then dereferences NULL. The kernel panics from timer (softirq) context. On a KASAN build this shows up as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, which is offsetof(struct mt_application, num_received). The state is reachable from an untrusted USB or Bluetooth HID multitouch device; no local privileges are required. Store the per-slot active state in a separately allocated bitmap sized for maxcontacts, the same pattern already used for pending_palm_slots, and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two "mt_io_flags & MT_IO_SLOTS_MASK" arming checks become bitmap_empty(td->active_slots, td->maxcontacts). Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the same commit to leave the low byte for the slot bits; with the slot bits gone it fits in bit 0 again, which also keeps it within the unsigned long on 32-bit.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fc488f675344931ffab6a51c43691065ec006567 , < 12e90656e330ff8bbaf2f29c535fdb8a11cc6f55 (git)
Affected: 77711d850bed75ae7142c3d1f22c1a8b4d049c33 , < 152983d87387f6a8ae72b73474cfa55fbcf1ec75 (git)
Affected: 6acfe25968913788d30ec0eedd80178c4ea3f1d0 , < b5c037d6b807017e74a115288f81bc9cd5a5aab8 (git)
Affected: d280c138e66be87d1fccfed42593f02fdb893905 , < a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d (git)
Affected: f32fea4c0234c971c12e46d76612cdc2dd4bb046 , < e24918ee67c4dc3d20d4670750e46e9b160365f4 (git)
Affected: 46f781e0d151844589dc2125c8cce3300546f92a , < 37daa8c96bd563d03150e23f094cb60703594a6d (git)
Affected: 46f781e0d151844589dc2125c8cce3300546f92a , < 6493ebf9489efef0105078377b973ab33d51af22 (git)
Affected: 46f781e0d151844589dc2125c8cce3300546f92a , < 8813b0612275cc61fe9e6603d0ee019247ade6be (git)
Affected: 59bd04163e6451b9c7275277882ed9f4abfa2051 (git)
Affected: 5.10.246 , < 5.10.261 (semver)
Affected: 5.15.196 , < 5.15.212 (semver)
Affected: 6.1.158 , < 6.1.178 (semver)
Affected: 6.6.114 , < 6.6.145 (semver)
Affected: 6.12.55 , < 6.12.97 (semver)
Affected: 6.17.5 , < 6.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
              "status": "affected",
              "version": "fc488f675344931ffab6a51c43691065ec006567",
              "versionType": "git"
            },
            {
              "lessThan": "152983d87387f6a8ae72b73474cfa55fbcf1ec75",
              "status": "affected",
              "version": "77711d850bed75ae7142c3d1f22c1a8b4d049c33",
              "versionType": "git"
            },
            {
              "lessThan": "b5c037d6b807017e74a115288f81bc9cd5a5aab8",
              "status": "affected",
              "version": "6acfe25968913788d30ec0eedd80178c4ea3f1d0",
              "versionType": "git"
            },
            {
              "lessThan": "a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
              "status": "affected",
              "version": "d280c138e66be87d1fccfed42593f02fdb893905",
              "versionType": "git"
            },
            {
              "lessThan": "e24918ee67c4dc3d20d4670750e46e9b160365f4",
              "status": "affected",
              "version": "f32fea4c0234c971c12e46d76612cdc2dd4bb046",
              "versionType": "git"
            },
            {
              "lessThan": "37daa8c96bd563d03150e23f094cb60703594a6d",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "lessThan": "6493ebf9489efef0105078377b973ab33d51af22",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "lessThan": "8813b0612275cc61fe9e6603d0ee019247ade6be",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "59bd04163e6451b9c7275277882ed9f4abfa2051",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.246",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.196",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.158",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A malicious Bluetooth HID multitouch peripheral within radio range can supply the descriptor, feature value, and input reports; malicious USB devices provide an additional physical path.\nAC:L - Advertising 250 contacts, sending one active contact, and remaining silent for 100 ms deterministically triggers the timer path without a race, heap grooming, or uncontrollable condition.\nPR:N - The external HID device needs no target-system account or capability, and normal HID connection handling delivers its attacker-controlled data to the driver.\nUI:N - An already-connected or automatically reconnecting Bluetooth peripheral can trigger the flaw without victim action; report processing itself requires no file, prompt, or application interaction.\nS:U - The corruption occurs in the host kernel and compromises resources governed by that same kernel security authority.\nC:H - Attacker-controlled out-of-bounds bit operations cover adjacent list pointers and can redirect subsequent kernel memory accesses, supporting kernel compromise and arbitrary disclosure.\nI:H - The device obtains attacker-directed set/clear operations over adjacent pointer fields, enabling crafted pointer corruption, further kernel writes, and potentially code execution.\nA:H - The deterministic timeout path corrupts the applications list and causes a kernel panic from softirq context, and a malicious peripheral can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:11.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55"
        },
        {
          "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22"
        },
        {
          "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be"
        }
      ],
      "title": "HID: multitouch: fix out-of-bounds bit access on mt_io_flags",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64364",
    "datePublished": "2026-07-25T08:50:19.441Z",
    "dateReserved": "2026-07-19T15:36:31.783Z",
    "dateUpdated": "2026-08-17T04:54:11.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64364",
      "date": "2026-09-21",
      "epss": "0.00354",
      "percentile": "0.2909"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:41:11.000Z",
      "cve": "CVE-2026-64364",
      "id": "msrc_CVE-2026-64364",
      "initial_release_date": "2026-07-26T01:10:39.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HID: multitouch: fix out-of-bounds bit access on mt_io_flags",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64364.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-multitouch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
                    "status": "affected",
                    "version": "fc488f675344931ffab6a51c43691065ec006567",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "152983d87387f6a8ae72b73474cfa55fbcf1ec75",
                    "status": "affected",
                    "version": "77711d850bed75ae7142c3d1f22c1a8b4d049c33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5c037d6b807017e74a115288f81bc9cd5a5aab8",
                    "status": "affected",
                    "version": "6acfe25968913788d30ec0eedd80178c4ea3f1d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
                    "status": "affected",
                    "version": "d280c138e66be87d1fccfed42593f02fdb893905",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e24918ee67c4dc3d20d4670750e46e9b160365f4",
                    "status": "affected",
                    "version": "f32fea4c0234c971c12e46d76612cdc2dd4bb046",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "37daa8c96bd563d03150e23f094cb60703594a6d",
                    "status": "affected",
                    "version": "46f781e0d151844589dc2125c8cce3300546f92a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6493ebf9489efef0105078377b973ab33d51af22",
                    "status": "affected",
                    "version": "46f781e0d151844589dc2125c8cce3300546f92a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8813b0612275cc61fe9e6603d0ee019247ade6be",
                    "status": "affected",
                    "version": "46f781e0d151844589dc2125c8cce3300546f92a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "59bd04163e6451b9c7275277882ed9f4abfa2051",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.261",
                    "status": "affected",
                    "version": "5.10.246",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.212",
                    "status": "affected",
                    "version": "5.15.196",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.178",
                    "status": "affected",
                    "version": "6.1.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.97",
                    "status": "affected",
                    "version": "6.12.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "affected",
                    "version": "6.17.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hid/hid-multitouch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "72CE0BCB-E931-4062-AEC1-BD286F06EFD2",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "5.10.246",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "35A42A8C-A02C-4A52-A27B-31BF30340A35",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.15.196",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F0E35CD9-BE71-41CE-BEAA-F257DDE46494",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "6.1.158",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E29121D8-3A72-421B-AA20-A66AF9E033DE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.6.114",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83DF16B7-EB70-4279-82FC-17A8CCF3F8CC",
                    "versionEndExcluding": "6.12.97",
                    "versionStartIncluding": "6.12.55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27929282-2519-484B-B04C-5B62B31FBC5E",
                    "versionEndExcluding": "6.18",
                    "versionStartIncluding": "6.17.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F64A7C83-15C4-42D8-97A5-F14BB7E7220D",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.18.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*",
                    "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."
          }
        ],
        "id": "CVE-2026-64364",
        "lastModified": "2026-09-10T21:35:45.760",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:19.110",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-29T10:20:37+00:00",
      "cve": "CVE-2026-64364",
      "id": "CVE-2026-64364",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "261",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: HID: multitouch: fix out-of-bounds bit access on mt_io_flags",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64364.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:51:03Z",
      "cve": "CVE-2026-64364",
      "id": "CVE-2026-64364",
      "initial_release_date": "2026-07-25T16:00:55Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "347",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64364",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64364.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.