CVE-2026-64237: Input: elan_i2c - validate firmware size before use
Published Jul 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Input: elani2c - validate firmware size before use
Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before accessing them to prevent potential out-of-bounds reads.
Affected Software
13 affected components
Linux Linux kernel
Linux Linux kernel>=4.0<5.10.259
Linux Linux kernel>=5.11<5.15.210
Linux Linux kernel>=5.16<6.1.176
Linux Linux kernel>=6.2<6.6.143
Linux Linux kernel>=6.7<6.12.93
Linux Linux kernel>=6.13<6.18.35
Linux Linux kernel>=6.19<7.0.12
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3
Linux Linux kernel=7.1-rc4
Linux Linux kernel=7.1-rc5
Remediation
Event History
Jul 24, 2026
CVE Published
via MITRE·03:27 PM
Data Sourced
via MITRE·03:27 PM
Description
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-64237?
CVE-2026-64237 has a high severity rating of 7.1 on the CVSS scale.
2
How do I fix CVE-2026-64237?
To fix CVE-2026-64237, apply the patch provided by the Linux kernel developers.
3
What type of vulnerability is CVE-2026-64237?
CVE-2026-64237 is related to input validation issues in the elan_i2c component of the Linux kernel.
4
What can happen if CVE-2026-64237 is exploited?
Exploitation of CVE-2026-64237 may allow unauthorized access to firmware images, leading to potential system compromise.
5
When was CVE-2026-64237 published?
CVE-2026-64237 was published on July 24, 2026.