The vulnerability originates from a mismatch between the event size expected by the mms114 driver (8 bytes) and the actual 6‑byte packets generated by the MMS134S and MMS136 touch controllers. The driver treats each event as an 8‑byte struct and therefore reads subsequent events from incorrect offsets, causing malformed touch data to be processed. The defect does not lead to memory corruption, remote code execution, or privilege escalation; it merely results in inaccurate or unpredictable touch input handling that can degrade device usability.

The flaw affects any Linux kernel build that includes the mms114 driver for the MMS134S or MMS136 controllers. Systems running older kernels that have not incorporated the upstream patch, custom kernel configurations that compile the driver, or distributions that ship the affected driver without correcting the event calculation are all potentially vulnerable. Updating to a kernel that contains the event‑size fix or disabling the driver resolves the issue.

Because the vulnerability involves only incorrect parsing of touch packets, it does not expose a memory overflow or code execution path. Exploitation would require local, physical access to inject malformed touch data and the flaw does not provide a means for privilege escalation. The EPSS score of < 1% and absence from the CISA KEV catalog indicate a very low likelihood of real‑world exploitation. Consequently, the overall risk to systems that use the affected driver is minimal, though it can impact device usability.