Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-64014
Linux Linux — Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U H N H 7.1 .0013 2.0 —
AFFECTED
Product Versions Fixed
Linux 5197424cdcccd2b0b1922babb93969b2515c43ce – —
Linux 2.6.34 – 5.10.259
TIMELINE
Jul 19 Reserved by Linux
Jul 19 Published (CNA: Linux)
Oct 13 ENRICHED — CVE-2026-64014 (Linux). Received CVSS 7.1 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
nexio_read_data() pulls data_len and x_len from a packed __be16 header
in the device's interrupt packet and then walks packet->data[0..x_len)
and packet->data[x_len..data_len) comparing each byte against a
threshold.
Both fields are 16-bit on the wire (max 65535). The existing
adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size
(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
packed header — so packet->data[] has 1017 valid bytes. read_data()
callbacks are not given urb->actual_length, and nothing else bounds the
walk.
A device that lies about its length can get a ~64 KiB out-of-bounds read
past the coherent DMA allocation. The first index whose byte exceeds
NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
reported touch coordinates, so adjacent kernel memory contents leak to
userspace as ABS_X / ABS_Y events. Far enough out, the read can also
hit an unmapped page and fault.
Fix this all by clamping data_len to the buffer's data[] capacity and
x_len to data_len.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| July 19, 2026 | Reserved | Reserved by Linux |
| July 19, 2026 | Published | Published (CNA: Linux) |
| October 13, 2026 | ENRICHED | ENRICHED — CVE-2026-64014 (Linux). Received CVSS 7.1 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 5197424cdcccd2b0b1922babb93969b2515c43ce | — |
| Linux | Linux | — | 2.6.34 | 5.10.259 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64014 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
