CVE-2026-64271: Input: touchwin - reset the packet index on every complete packet

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Input: touchwin - reset the packet index on every complete packet

tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:

	tw->data[tw->idx++] = data;
	if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
		...
		tw->idx = 0;
	}

The reset is gated on tw->data[1] == tw->data[2], a value the device
controls.  A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.

Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.

The Linux kernel CVE team has assigned CVE-2026-64271 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 5.10.261 with commit ed9b66905407eb3d02df1aaeed82eb7a7f0eb508
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 5.15.212 with commit 044167cba2384bcd783547ad5e30ecd292b30919
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 6.1.178 with commit 6c9f29f128dd4057404838259af4c645318487e1
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 6.6.145 with commit 431ad239f2924dff337c3fccb9246597c1b63185
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 6.12.96 with commit 70e4248793762df9832fd4fc2fc6ac7924572c36
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 6.18.39 with commit 3e6f007b43e2fc6546e21fa74ee62c38984a6672
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 7.1.4 with commit a8d87184576c889759e3aab899799a482f1e1a5b
	Issue introduced in 2.6.19 with commit 11ea3173d5f2de71d037ef58ac43395795fed2bc and fixed in 7.2-rc1 with commit 478cdd736f2ce3114f90e775d7358136d3977b94

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64271
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/input/touchscreen/touchwin.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508
	https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919
	https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1
	https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185
	https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36
	https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672
	https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b
	https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94