CVE-2026-64271: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64271 Overview

CVE-2026-64271 is a heap out-of-bounds write vulnerability in the Linux kernel touchwin serial touchscreen input driver. The flaw resides in tw_interrupt(), which accumulates serial bytes into a fixed three-byte buffer inside the heap-allocated struct tw. The buffer index is only reset when a full packet arrives and the device's two Y bytes agree. A malicious or counterfeit Touchwindow peripheral can stream non-zero bytes whose second and third bytes never match, causing the index to grow past TW_LENGTH and write attacker-controlled bytes off the end of the array into adjacent heap memory.

Critical Impact
An unbounded, device-driven heap out-of-bounds write triggered by a malicious or malfunctioning USB or serial Touchwindow peripheral, corrupting the struct tw heap allocation one attacker-chosen byte at a time.

Affected Products

Linux kernel drivers/input/touchscreen/touchwin.c serial touchscreen driver
Linux distributions shipping the touchwin input module prior to the referenced stable patches
Systems that expose serial input device attachment (physical access or susceptible peripheral bus)

Discovery Timeline

2026-07-25 - CVE-2026-64271 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64271

Vulnerability Analysis

The touchwin driver implements a serial input protocol where each interrupt handler invocation appends one non-zero byte into tw->data[tw->idx++]. The driver assumes the peripheral behaves cooperatively and only resets tw->idx when both tw->idx == TW_LENGTH and tw->data[1] == tw->data[2] conditions are true. The equality check depends on values the device itself supplies, so a hostile device controls whether the reset ever executes. When the equality never holds, tw->idx increments past the three-byte bound and writes continue into adjacent fields of the heap-allocated struct tw.

Root Cause

The root cause is missing input validation on device-supplied data used to guard a critical loop-termination condition. The driver conflates "packet complete" with "packet valid," gating the reset on payload equality rather than on packet length alone. This is a classic out-of-bounds write [CWE-787] triggered by device-controlled input.

Attack Vector

An attacker with the ability to attach a serial peripheral, such as a counterfeit or reprogrammed USB-serial Touchwindow device, can send crafted byte streams where the second and third bytes always differ. Each subsequent non-zero byte becomes an attacker-chosen write to a location past the three-byte buffer inside the heap-allocated tw structure. Because the write is unbounded, an attacker can corrupt neighbouring kernel heap objects, potentially escalating to arbitrary kernel memory corruption and privilege escalation. See the description in the CVE record for the vulnerable code snippet in tw_interrupt().

Detection Methods for CVE-2026-64271

Indicators of Compromise

Kernel oops, panic, or SLUB/SLAB corruption messages referencing touchwin, tw_interrupt, or nearby input subsystem symbols
Attachment of unexpected serial input devices identifying as Touchwindow touchscreens on systems where such peripherals are not authorized
Repeated malformed serial packets from an input device where the second and third payload bytes never match

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test and pre-production kernels to catch the out-of-bounds write at the point of corruption
Audit loaded kernel modules for touchwin on systems that do not require serial touchscreen support and flag its presence
Alert on dmesg entries indicating slab corruption, use-after-free, or general protection faults originating in input serio drivers

Monitoring Recommendations

Track USB and serial device attachment events via udev and forward them to centralized logging for anomaly review
Monitor kernel crash telemetry for input-driver stack traces after peripheral attach events
Correlate physical peripheral inventory against runtime lsmod output to identify unauthorized driver loads

How to Mitigate CVE-2026-64271

Immediate Actions Required

Apply the upstream Linux stable patches referenced in the CVE record, which reset tw->idx on every completed packet and only report events when the two Y bytes agree
Blacklist the touchwin module on systems that do not use Touchwindow serial touchscreens
Restrict physical and USB access to systems handling sensitive workloads to prevent attachment of hostile serial peripherals

Patch Information

The fix is distributed across multiple Linux stable branches. Relevant commits: Kernel Patch 044167cb, Kernel Patch 3e6f007b, Kernel Patch 431ad239, Kernel Patch 478cdd73, Kernel Patch 6c9f29f1, Kernel Patch 70e42487, Kernel Patch a8d87184, and Kernel Patch ed9b6690. The patched behavior mirrors other serio touchscreen drivers by resetting the packet index unconditionally at packet completion.

Workarounds

Prevent module autoload by adding blacklist touchwin and install touchwin /bin/true entries under /etc/modprobe.d/ on systems that never use Touchwindow devices
Disable serial input serio port attachment for untrusted physical device paths via kernel command-line or udev rules
Enforce USB device authorization policies to allow only pre-approved input peripherals in high-assurance environments

bash

# Configuration example: block the touchwin module on unaffected systems
echo 'blacklist touchwin' | sudo tee /etc/modprobe.d/blacklist-touchwin.conf
echo 'install touchwin /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-touchwin.conf
sudo depmod -a
sudo update-initramfs -u