PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64014 Linux CVE debrief

A vulnerability was found in the Linux kernel's usbtouchscreen module. The issue occurs when the module fails to properly clamp the data_len and x_len values from a packed __be16 header in the device's interrupt packet. This can lead to an out-of-bounds read past the coherent DMA allocation, potentially leaking adjacent kernel memory contents to userspace as ABS_X / ABS_Y events. The vulnerability can be mitigated by clamping data_len to the buffer's data[] capacity and x_len to data_len.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability and take steps to mitigate it. Affected Linux kernel deployments should be reviewed for potential exposure, and compensating controls should be considered for exposed systems.

Technical summary

The vulnerability is caused by the usbtouchscreen module's failure to properly validate the data_len and x_len values from a packed __be16 header in the device's interrupt packet. This can lead to an out-of-bounds read past the coherent DMA allocation, potentially leaking adjacent kernel memory contents to userspace as ABS_X / ABS_Y events. The vulnerability can be mitigated by clamping data_len to the buffer's data[] capacity and x_len to data_len. The affected module is part of the Linux kernel, and the vulnerability can be exploited by a device that lies about its length.

Defensive priority

High

Recommended defensive actions

  • Review and apply the provided patches to the Linux kernel's usbtouchscreen module.
  • Ensure that Linux kernel updates are properly tested and validated before deployment.
  • Monitor Linux kernel updates and patches for potential vulnerabilities.
  • Consider implementing additional security controls, such as memory protection and address space layout randomization (ASLR).
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was discovered and reported by an unknown source. The CVE record was published on 2026-07-19T16:17:41.320Z and has not been modified since then. The NVD entry is currently Received. Evidence is limited, and defenders should verify the affected scope, severity, and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:41.320Z and has not been modified since then.