PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64364 Linux CVE debrief

A Linux kernel vulnerability allows out-of-bounds bit access on mt_io_flags, potentially causing a kernel panic from timer (softirq) context. This issue arises from the HID multitouch driver's improper use of a single unsigned long as a per-slot bitmap indexed by the slot number, which can be up to 255. The vulnerability can cause system instability and potential crashes. Linux kernel developers, maintainers, and users should verify and limit exposure of affected systems. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs for (i = 0; i < mt->num_slots; i++) clear_bit(i, &td->mt_io_flags); with num_slots == maxcontacts. For maxcontacts 250-

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-25
Original CVE updated
2026-10-19
Advisory published
2026-07-25
Advisory updated
2026-10-19

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems, particularly those using HID multitouch devices, should be aware of this vulnerability. They should review and apply patches, update their Linux kernels, and verify the exposure of affected systems. Additionally, security teams and vulnerability management teams should prioritize this vulnerability and take necessary actions to mitigate potential risk

Why it matters

The Linux kernel's HID multitouch driver vulnerability requires patching and updating to prevent potential kernel panic and system instability. Linux kernel developers, maintainers, and users should verify and limit exposure of affected systems.

  • Potential kernel panic from timer (softirq) context
  • Possible system instability or crash
  • Required patching and updating of Linux kernel
  • Verification of Linux kernel versions and exposure

Technical summary

The Linux kernel's HID multitouch driver has a vulnerability that allows out-of-bounds bit access on mt_io_flags. This occurs because the driver uses a single unsigned long as a per-slot bitmap indexed by the slot number, which can be up to 255. This can cause a kernel panic from timer (softirq) context. The vulnerability is caused by the Linux kernel's HID multitouch driver incorrectly using a single unsigned long as a per-slot bitmap. This can lead to out-of-bounds bit access and potential kernel panic. The issue is exacerbated by the fact that the slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report.

Defensive priority

High

Recommended defensive actions

  • Review and apply the provided patches to the Linux kernel
  • Update Linux kernel to version 6.18 or later
  • Verify and limit exposure of affected systems
  • Monitor Linux kernel updates for potential vulnerabilities
  • Perform a thorough review of system logs to detect potential exploitation attempts
  • Implement additional monitoring and detection mechanisms for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by the Linux kernel's HID multitouch driver incorrectly using a single unsigned long as a per-slot bitmap. This can lead to out-of-bounds bit access and potential kernel panic.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64364 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64364

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64364 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64364

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • HID: multitouch: fix out-of-bounds bit access on mt_io_flags

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64364.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.