CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

nexio_read_data() pulls data_len and x_len from a packed __be16 header
in the device's interrupt packet and then walks packet->data[0..x_len)
and packet->data[x_len..data_len) comparing each byte against a
threshold.

Both fields are 16-bit on the wire (max 65535).  The existing
adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
reach roughly 0xfeff.  The URB transfer buffer for NEXIO is rept_size
(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
packed header — so packet->data[] has 1017 valid bytes.  read_data()
callbacks are not given urb->actual_length, and nothing else bounds the
walk.

A device that lies about its length can get a ~64 KiB out-of-bounds read
past the coherent DMA allocation.  The first index whose byte exceeds
NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
reported touch coordinates, so adjacent kernel memory contents leak to
userspace as ABS_X / ABS_Y events.  Far enough out, the read can also
hit an unmapped page and fault.

Fix this all by clamping data_len to the buffer's data[] capacity and
x_len to data_len.

The Linux kernel CVE team has assigned CVE-2026-64014 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 5.10.259 with commit 45c829e5eb3b974282bae50b7cca2cc891f74f0b
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 5.15.210 with commit e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.1.176 with commit 95f47331dfde243f93e679ce70bd0c24b37c683d
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.6.143 with commit d883312061ccde8c536595998aaf687ec070077c
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.12.93 with commit 103d2de9f505f56da173e43f12dba62f92620278
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 6.18.35 with commit 0ca809ea8e0355299266c46e5f1755040aa8dcf3
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 7.0.12 with commit 7585b6aa55d8ac85ad22f522e1059f93507727b6
	Issue introduced in 2.6.34 with commit 5197424cdcccd2b0b1922babb93969b2515c43ce and fixed in 7.1 with commit 2905281cbda52ec9df540113b35b835feb5fafd3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64014
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/input/touchscreen/usbtouchscreen.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b
	https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb
	https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d
	https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c
	https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278
	https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3
	https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6
	https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3