CVE-2026-64275: Input: elan_i2c - prevent division by zero and arithmetic underflow
In the Linux kernel, the following vulnerability has been resolved:
Input: elani2c - prevent division by zero and arithmetic underflow
The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for xtraces or ytraces, it results in a fatal division-by-zero exception leading to a kernel panic during device probe.
Add checks to ensure these parameters are non-zero before performing the division. If invalid trace values are detected, fall back to a safe default of 1.
Additionally, prevent an arithmetic underflow in the touch reporting logic. Previously, if the calculated or fallback width was smaller than ETPFWIDTHREDUCE (90), the subtraction would underflow, resulting in a massive unsigned integer being reported to userspace. Clamp the adjusted width to a minimum of 0 to safely handle small physical dimensions and fallback scenarios.
Completing the probe with safe fallback values ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
When applying ETP_FWIDTH_REDUCE (90) and performing the subtraction during width calculation, clamp the adjusted width to a minimum of 0 to prevent arithmetic underflow (and avoid creating sysfs nodes with invalid values).
Linux kernel elan_i2c (touchpad driver) ETP_FWIDTH_REDUCE (90) subtraction result handling = Clamp adjusted width to a minimum of 0 - Configuration
Before performing division during device resolution/width calculation, add checks to ensure trace-count parameters (x_traces and y_traces) are non-zero. If invalid trace values (including zero) are detected from firmware/device tree, use the safe fallback values (e.g., the driver’s default of 1) to prevent division-by-zero and arithmetic underflow.
Linux kernel elan_i2c (touchpad driver) x_traces/y_traces (device-provided trace values) validation and fallback = Fallback to safe values when x_traces or y_traces are invalid or zero; ensure non-zero before division
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64275?
The severity of CVE-2026-64275 is medium with a CVSS score of 5.5.
What are the potential impacts of CVE-2026-64275?
CVE-2026-64275 can lead to a denial-of-service condition due to division by zero and arithmetic underflow.
How do I fix CVE-2026-64275?
To fix CVE-2026-64275, update the Linux Kernel to the fixed version released after July 25, 2026.
Which software is affected by CVE-2026-64275?
CVE-2026-64275 affects the Elan I2C touchpad driver within the Linux Kernel.
When was CVE-2026-64275 published?
CVE-2026-64275 was published on July 25, 2026.