The usbtouchscreen driver for NEXIO touchscreens extracts two 16‑bit length fields from an interrupt packet and uses them to walk a USB request block (URB) buffer without bounding the indices to the actual buffer size. This allows a packet that advertises a length far larger than the 1017‑byte buffer to trigger an out‑of‑bounds read of up to roughly 64 KiB. The over‑read copies kernel memory into user‑space ABS_X and ABS_Y events, leaking arbitrary kernel data and potentially causing a fault if the read reaches an unmapped page. The weakness is classified as CWE‑125.

Any Linux kernel that still loads the usbtouchscreen driver and has not integrated the commit that clamps data_len and x_len to the URB size. The driver activates when a NEXIO touchscreen is plugged in and creates a 1024‑byte USB coherent buffer, leaving 1017 bytes valid for the data payload. No specific kernel versions are listed, so all releases before the patch are considered affected.

The CVSS score of 5.5 indicates a moderate risk; the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not present in the CISA KEV catalogue. The flaw can be triggered by a malicious USB device that an attacker can connect directly to the target machine, making the attack vector local and device‑specific. While the impact is primarily information disclosure and the potential for a crash, the overall severity is moderate for environments that allow untrusted USB peripherals.