CVE-2026-64237: Linux Kernel elan_i2c Input Vulnerability

CVE-2026-64237 Overview

CVE-2026-64237 is an out-of-bounds read vulnerability in the Linux kernel elan_i2c input driver. The driver failed to validate the size of the firmware file before accessing the expected number of pages and the firmware signature located at the end of the blob. A crafted or truncated firmware file supplied to the driver could trigger reads past the end of the allocated buffer.

The issue has been resolved by adding size validation prior to firmware parsing. Multiple stable kernel branches received corresponding patches.

Critical Impact
Out-of-bounds reads in kernel context can lead to information disclosure of adjacent kernel memory or driver instability affecting systems using Elan I2C touchpad hardware.

Affected Products

Linux kernel elan_i2c input driver
Stable kernel branches referenced by upstream commits 331d49b, 3b37190a, 47b52b98, 48b0aa9c, 76b0d0ba, bf769358, c2c3b33b, and d97baee9
Distributions shipping affected stable kernels prior to backporting the fix

Discovery Timeline

2026-07-24 - CVE-2026-64237 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64237

Vulnerability Analysis

The elan_i2c driver loads firmware blobs used to update Elan touchpad controllers. The firmware parser calculated offsets for a fixed number of pages and read a signature from the end of the blob without first confirming that the file was large enough to contain those structures.

When a firmware file smaller than expected reaches the parser, pointer arithmetic produces addresses outside the allocated buffer. The subsequent read dereferences memory belonging to adjacent kernel allocations, classifying the flaw as an out-of-bounds read [CWE-125].

The EPSS score is 0.165%, reflecting a low predicted probability of exploitation in the near term. Exploitation requires the ability to supply a malicious firmware image to the driver, which typically demands elevated local privileges or physical access.

Root Cause

The root cause is missing input validation on the firmware blob size prior to indexing into it. The parser trusted the file length implicitly and computed page offsets and signature offsets without bounds checks.

Attack Vector

A local actor with the ability to place or replace firmware files consumed by the driver, or a hardware update path that delivers an undersized blob, can trigger the out-of-bounds read. The impact is limited to kernel memory disclosure or driver-level fault rather than direct code execution.

The vulnerability is a validation flaw rather than an exploitable memory corruption primitive, so no proof-of-concept exploitation code is required to describe it. Refer to the Linux Kernel Patch 331d49b and Linux Kernel Patch d97baee9 for the exact validation logic added upstream.

Detection Methods for CVE-2026-64237

Indicators of Compromise

Unexpected elan_i2c driver errors or kernel log entries referencing firmware parsing failures
Presence of modified or truncated Elan touchpad firmware files under /lib/firmware/elan_i2c/
Kernel oops or KASAN reports naming elan_i2c functions during firmware load

Detection Strategies

Inventory endpoints running stable Linux kernels with the elan_i2c module loaded and compare kernel versions against patched builds
Enable KASAN in test builds to surface out-of-bounds reads triggered by malformed firmware during QA
Monitor package management events that install or replace kernel modules and firmware packages

Monitoring Recommendations

Collect and alert on dmesg entries containing elan_i2c load or signature errors
Track file integrity of /lib/firmware/elan_i2c/ and flag unauthorized modifications
Correlate driver load events with the presence of unexpected local privilege changes

How to Mitigate CVE-2026-64237

Immediate Actions Required

Update affected systems to a Linux kernel release that includes the upstream fix commits listed in the references
Restrict write access to firmware directories to root-only and validate firmware provenance during deployment
Unload the elan_i2c module on systems that do not require Elan touchpad support

Patch Information

The fix adds explicit size validation before the driver reads page data or the trailing signature from the firmware blob. Backports are available across multiple stable branches via commits 331d49b, 3b37190a, 47b52b98, 48b0aa9c, 76b0d0ba, bf769358, c2c3b33b, and d97baee9. Apply the kernel package from your distribution vendor once the fix is included.

Workarounds

Blacklist the elan_i2c module on systems without Elan touchpad hardware to eliminate the attack surface
Enforce strict file permissions and signed-package delivery on /lib/firmware/ to prevent unauthorized firmware replacement
Deploy kernel lockdown or SecureBoot policies that limit which firmware blobs the kernel will consume

bash

# Example: prevent loading of the elan_i2c module on systems that do not need it
echo "blacklist elan_i2c" | sudo tee /etc/modprobe.d/blacklist-elan_i2c.conf
sudo update-initramfs -u