CVE-2026-64270: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64270 Overview

CVE-2026-64270 is a stack out-of-bounds write vulnerability in the Linux kernel mms114 touchscreen driver. The mms114_interrupt() function reads a touch data packet from an I2C device into a fixed-size on-stack buffer sized for MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes, totaling 80 bytes. The driver takes the packet_size value verbatim from a device register without bounding it against the destination buffer. A malfunctioning, malicious, or counterfeit controller (or an attacker tampering with the I2C bus) can report a packet_size of up to 255, causing __mms114_read_reg() to write up to 175 bytes past the buffer on the IRQ-thread stack.

Critical Impact
The out-of-bounds write can overwrite the stack canary, saved registers, and the return address on the IRQ-thread stack, enabling potential kernel memory corruption and code execution.

Affected Products

Linux kernel builds including the mms114 Melfas touchscreen input driver
Systems using MMS114-family I2C touchscreen controllers
Downstream distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64270 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64270

Vulnerability Analysis

The flaw resides in mms114_interrupt(), the interrupt handler for the Melfas MMS114 touchscreen driver. The handler allocates a fixed on-stack array struct mms114_touch touch[MMS114_MAX_TOUCH] capable of holding 80 bytes of touch event data. It then queries the device for the size of the pending packet by reading the MMS114_PACKET_SIZE register and passes that value directly to __mms114_read_reg() as the length parameter for an I2C bulk read into touch[]. The only sanity check validates that packet_size <= 0; there is no upper bound.

Because packet_size is a single byte device register, it can express values up to 255. Any value above 80 causes the I2C read to overrun the on-stack buffer by up to 175 bytes. This corruption occurs on the IRQ thread's stack, overwriting the stack canary, callee-saved registers, and the return address of the interrupt handler frame.

Root Cause

The root cause is missing input validation of untrusted device-supplied length data before it is used as the size of a kernel buffer copy. This is a classic stack-based out-of-bounds write pattern where a hardware-controlled length value is trusted implicitly. The affected code path does not enforce packet_size <= sizeof(touch) before invoking the I2C read.

Attack Vector

Exploitation requires an attacker capable of controlling the values reported by the MMS114 I2C controller. Realistic scenarios include a counterfeit or maliciously reprogrammed touchscreen controller, a supply-chain implant, or physical tampering with the I2C bus between the SoC and the touch controller. When the driver services an interrupt from such a controller, the malicious packet_size value triggers the overflow inside the IRQ thread context, corrupting kernel stack memory and potentially redirecting kernel control flow.

The upstream fix rejects any packet_size value that exceeds the size of the destination buffer and drops the report, matching the handler's existing error-path behavior. See the referenced stable kernel commits (5d2ea15, 6672503, 8301c33, b781507, f3d5e77) for the exact patch content. No verified proof-of-concept code is available for this issue.

Detection Methods for CVE-2026-64270

Indicators of Compromise

Unexpected kernel oops, panic, or stack-protector (__stack_chk_fail) messages referencing mms114_interrupt or __mms114_read_reg in dmesg or persistent kernel logs.
Unexplained resets or crashes on devices equipped with MMS114-family touchscreen controllers, particularly following hardware servicing or repair.
I2C bus traffic showing MMS114_PACKET_SIZE register values larger than 80 (0x50).

Detection Strategies

Inventory Linux endpoints and embedded systems and identify kernels compiled with CONFIG_TOUCHSCREEN_MMS114 enabled.
Compare running kernel versions against distribution advisories that reference the upstream fix commits to determine patch state.
Enable kernel hardening features such as CONFIG_STACKPROTECTOR_STRONG and monitor for stack canary violations as a secondary detection signal.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log platform and alert on kernel panics referencing mms114.
Track unexpected reboots on kiosks, POS devices, and embedded Linux systems with touchscreens.
Monitor for physical tamper events on hardware exposing the I2C bus to untrusted access.

How to Mitigate CVE-2026-64270

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits 5d2ea15, 6672503, 8301c33, b781507, and f3d5e77 as they become available in your distribution.
Update all Linux systems using the mms114 driver to a fixed kernel release from your vendor.
Restrict physical access to devices with MMS114 touchscreen controllers to reduce I2C tampering risk.

Patch Information

The fix adds a bounds check that rejects any packet_size value exceeding the size of the on-stack touch[] buffer and drops the report, consistent with other error paths in the interrupt handler. Distribution vendors are backporting the change to supported stable kernel branches. Review the Linux stable tree commits referenced in this CVE for the exact code change and applicable branches.

Workarounds

Disable the mms114 driver on systems that do not require MMS114 touchscreen support by unloading the module or rebuilding without CONFIG_TOUCHSCREEN_MMS114.
Enforce hardware supply-chain controls and validate touchscreen controller firmware to reduce the risk of counterfeit or tampered devices.
Prevent physical access to internal I2C buses through tamper-evident enclosures on embedded and kiosk deployments.

bash

# Check whether the mms114 driver is present and loaded
grep -i CONFIG_TOUCHSCREEN_MMS114 /boot/config-$(uname -r)
lsmod | grep mms114

# Unload the driver where the touchscreen is not required
sudo modprobe -r mms114

# Blacklist to prevent auto-load on reboot
echo 'blacklist mms114' | sudo tee /etc/modprobe.d/blacklist-mms114.conf