CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags
HID: multitouch: fix out-of-bounds bit access on mtioflags
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
Apply the upstream fix for the HID multitouch out-of-bounds bit access by moving MT_IO_FLAGS_RUNNING back to bit 0, and store per-slot active state in a separately allocated bitmap sized by maxcontacts; do not allow per-slot bit operations to overlap adjacent members of struct mt_device via mt_io_flags.
Linux kernel (HID multitouch driver) mt_io_flags bit layout = Move MT_IO_FLAGS_RUNNING back to bit 0 and keep only MT_IO_FLAGS_RUNNING in mt_io_flags
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems using the Linux kernel HID multitouch driver are exposed when they interact with a multitouch device whose ContactCountMaximum permits a large number of contacts. The affected slot count can be as high as 255 according to the device feature report.
What does an attacker need to trigger the vulnerability?
An attacker needs access to a malicious or specially crafted HID multitouch device that advertises a large contact count. No privileges or user interaction are required by the CVSS vector, and exploitation is assessed as adjacent-network attackable.
What is the likely impact if the issue is triggered?
Out-of-bounds bit operations corrupt adjacent members of the multitouch device structure. A demonstrated path can zero a list head and cause a NULL dereference, panicking the kernel from timer softirq context; the listed CVSS impact includes high confidentiality, integrity, and availability impact.
How can exposure be reduced before applying a fix?
Avoid connecting or permitting untrusted HID multitouch devices, particularly devices that can advertise unusually high ContactCountMaximum values. Restrict physical or nearby access to systems where HID devices can be attached.
How can I tell whether a system has encountered this issue?
Affected systems may show a kernel panic originating in timer or softirq context after multitouch contact processing. On KASAN-enabled builds, the issue can appear as a general protection fault.