CVE-2026-64237: Input: elan_i2c - validate firmware size before use
In the Linux kernel, the following vulnerability has been resolved:
Input: elani2c - validate firmware size before use
Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before accessing them to prevent potential out-of-bounds reads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate that the Elan I2C firmware blob is large enough to contain the expected number of pages and the signature at its end before accessing or reading them, preventing out-of-bounds reads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64237?
CVE-2026-64237 has a high severity rating of 7.1 on the CVSS scale.
How do I fix CVE-2026-64237?
To fix CVE-2026-64237, apply the patch provided by the Linux kernel developers.
What type of vulnerability is CVE-2026-64237?
CVE-2026-64237 is related to input validation issues in the elan_i2c component of the Linux kernel.
What can happen if CVE-2026-64237 is exploited?
Exploitation of CVE-2026-64237 may allow unauthorized access to firmware images, leading to potential system compromise.
When was CVE-2026-64237 published?
CVE-2026-64237 was published on July 24, 2026.