CVE-2026-64271 - Vulnerability Details

- Input: touchwin - reset the packet index on every complete packet

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: touchwin - reset the packet index on every complete packet

tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:

tw->data[tw->idx++] = data;
if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
...
tw->idx = 0;
}

The reset is gated on tw->data[1] == tw->data[2], a value the device
controls. A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.

Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the TouchWindow driver accumulates serial data in a three‑byte buffer and only resets the index when a full packet is received AND when the second and third bytes match the device‑controlled value. If the two bytes differ, the index never resets, causing the driver to write beyond the allocated buffer. This unbounded heap out‑of‑bounds write can target arbitrary kernel memory chosen by the peripheral, creating the possibility of escalating privileges. The flaw is a classic out‑of‑bounds write vulnerability (CWE‑129).

Affected Systems

The issue exists in any Linux kernel build that includes the TouchWindow driver before the patch commits referenced in the advisory. All kernels that ship with this driver and expose the TouchWindow serial interface are potentially affected. Affected kernel versions are not explicitly listed, so any kernel that has not applied these commits remains at risk.

Risk and Exploitability

This vulnerability, rated with a CVSS score of 7.8, allows an attacker with access to a TouchWindow peripheral to perform an unbounded heap out‑of‑bounds write. The EPSS score of less than 1 % reflects a very low likelihood of exploitation in the wild, and the issue has not been cited in CISA’s KEV catalog. However, the potential impact remains severe: a successful exploitation could lead to privilege escalation or remote code execution, especially on systems that run the vulnerable driver and accept data from the peripheral.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< ed9b66905407eb3d02df1aaeed82eb7a7f0eb508
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< 044167cba2384bcd783547ad5e30ecd292b30919
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< 6c9f29f128dd4057404838259af4c645318487e1
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< 431ad239f2924dff337c3fccb9246597c1b63185
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< 70e4248793762df9832fd4fc2fc6ac7924572c36
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< 3e6f007b43e2fc6546e21fa74ee62c38984a6672
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< a8d87184576c889759e3aab899799a482f1e1a5b
`11ea3173d5f2de71d037ef58ac43395795fed2bc`	affected	< 478cdd736f2ce3114f90e775d7358136d3977b94

Linux

affected

Version	Status	Constraints
`2.6.19`	affected	—
`0`	unaffected	< 2.6.19
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,ed9b66905407eb3d02df1aaeed82eb7a7f0eb508)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,044167cba2384bcd783547ad5e30ecd292b30919)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,3e6f007b43e2fc6546e21fa74ee62c38984a6672)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,431ad239f2924dff337c3fccb9246597c1b63185)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,70e4248793762df9832fd4fc2fc6ac7924572c36)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,a8d87184576c889759e3aab899799a482f1e1a5b)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,478cdd736f2ce3114f90e775d7358136d3977b94)`	affected	code_commit	—
`[11ea3173d5f2de71d037ef58ac43395795fed2bc,6c9f29f128dd4057404838259af4c645318487e1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.19`	affected	semver	—
`[0,2.6.19)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patched TouchWindow driver; see the commit references in the advisory.
If upgrading is not possible, disable or remove the TouchWindow driver or physically disconnect any TouchWindow peripheral from the host.
Monitor system logs for unusual TouchWindow activity and restrict physical access to trusted hardware to mitigate the risk of device‑based exploitation.

Generated by OpenCVE AI on August 13, 2026 at 20:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919
https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672
https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185
https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94
https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1
https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36
https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b
https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508
https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64271-b6b4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64271
https://www.cve.org/CVERecord?id=CVE-2026-64271

History

Thu, 13 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-129
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 01 Aug 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072559-CVE-2026-64271-b6b4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64271 https://www.cve.org/CVERecord?id=CVE-2026-64271
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Sun, 26 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_interrupt() accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and the device's two Y bytes agree: tw->data[tw->idx++] = data; if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) { ... tw->idx = 0; } The reset is gated on tw->data[1] == tw->data[2], a value the device controls. A malicious, malfunctioning or counterfeit Touchwindow peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the index reaches TW_LENGTH without the equality holding, is never reset, and keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte array and the rest of the heap-allocated struct tw, one attacker-chosen byte at a time -- an unbounded, device-driven heap out-of-bounds write. Reset the index on every completed packet and report an event only when the two Y bytes match, like the other serio touchscreen drivers do.
Title		Input: touchwin - reset the packet index on every complete packet
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919 https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672 https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185 https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94 https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1 https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36 https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:18.160Z

Updated: 2026-07-25T08:49:18.160Z

Reserved: 2026-07-19T15:36:31.775Z

Link: CVE-2026-64271

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:07.410

Modified: 2026-08-13T18:27:51.510

Link: CVE-2026-64271

Redhat

Severity : Important

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64271 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T20:15:03Z

Weaknesses

CWE-129
Improper Validation of Array Index

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object