CVE-2026-64272: Input: mms114 - fix touch indexing for MMS134S and MMS136
In the Linux kernel, the following vulnerability has been resolved:
Input: mms114 - fix touch indexing for MMS134S and MMS136
The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg() reads the touch data packet from the device into the touch buffer, the events are packed tightly at 6-byte intervals. However, the driver iterates through the events using standard C array indexing (touch[index]), where each element is sizeof(struct mms114touch) (8 bytes) apart. As a result, any touch events beyond the first one are read from incorrect offsets and parsed improperly.
Fix this by explicitly calculating the byte offset for each touch event based on the device's specific event size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel Input: mms114to a version that resolves this vulnerability.Patch Input: mms114 - fix touch indexing for MMS134S and MMS136
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems using the Linux kernel mms114 input driver with MMS134S or MMS136 touch controllers are affected. The incorrect indexing applies when processing touch data packets containing events beyond the first event.
What access does an attacker need to exploit this?
The CVSS vector indicates local access and low privileges are required, with no user interaction. The provided data does not describe a specific exploitation method beyond malformed parsing of touch-event data.
What is the impact of successful exploitation?
The issue is classified as an out-of-bounds read and has high confidentiality, integrity, and availability impacts in the supplied CVSS vector. It can cause touch events after the first event to be read from incorrect packet offsets and parsed improperly.
How can I tell whether a device needs the fix?
Determine whether the system uses an MMS134S or MMS136 touch controller and the Linux kernel mms114 driver. Affected behavior is associated with multi-event touch packets, because the first event is read correctly while subsequent events use incorrect offsets.