The Linux kernel MMS114 touchscreen driver accepts a packet size supplied by the device without restricting it against the 80‑byte on‑stack buffer. A malicious or malfunctioning controller can report a packet size of up to 255 bytes, causing the driver to read beyond the buffer boundary and overwrite the stack canary, saved registers, and return address. This kernel‑space out‑of‑bounds write can be leveraged to execute arbitrary code with kernel privileges.

The flaw exists in any Linux kernel that includes the MMS114 driver, a component shipped with mainstream distributions. The affected hardware is the MMS114 touchscreen controller accessed over I2C. Any device – laptops, embedded boards, or other systems – that mounts this controller and runs an unpatched kernel is vulnerable. No specific kernel version is listed, so all builds carrying the unpatched driver should be considered at risk.

The EPSS score is below 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no known mass exploitation. A successful exploit would likely require the attacker to influence the device register or tamper with the I2C bus; however, the specific conditions for such manipulation are not explicitly documented in the source. The description implies that physical proximity or compromised firmware might be involved, but this is inferred. With a successful exploit, kernel compromise would result, making the risk severe. The CVSS score of 7.8 classifies it as high severity.