CVE-2026-64272: Linux Kernel Touch Indexing Vulnerability

CVE-2026-64272 Overview

CVE-2026-64272 is a Linux kernel vulnerability in the mms114 input driver that mishandles touch event indexing for the MMS134S and MMS136 touch controllers. These controllers emit touch events packed at 6-byte intervals, but the driver iterates through them using standard C array indexing on struct mms114_touch, which is 8 bytes wide. As a result, any touch event after the first is read from an incorrect memory offset and parsed with corrupted field values. The kernel maintainers have merged fixes that explicitly compute the byte offset per event based on the device's declared event size.

Critical Impact
Malformed touch event parsing can corrupt input state and lead to out-of-bounds reads within the driver's touch buffer on affected Melfas MMS134S and MMS136 devices.

Affected Products

Linux kernel mms114 input driver (Melfas touchscreen controller)
Devices using the MMS134S touch controller
Devices using the MMS136 touch controller

Discovery Timeline

2026-07-25 - CVE-2026-64272 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64272

Vulnerability Analysis

The mms114 driver in the Linux kernel handles Melfas touchscreen controllers, including the MMS134S and MMS136 variants. Unlike other supported controllers, these two models emit touch events that are 6 bytes long rather than 8 bytes. The driver calls __mms114_read_reg() to copy a packet of touch data into a shared touch buffer, then walks through the events to parse each finger's coordinates and state.

The walk uses standard C array indexing of the form touch[index], where the element type is struct mms114_touch. That structure occupies 8 bytes, so each step of the iteration advances the pointer by 8 bytes. On MMS134S and MMS136 hardware, events are packed at 6-byte boundaries, so every event beyond the first is decoded from the wrong offset. This produces malformed coordinates, incorrect finger identifiers, and misaligned status bits.

The fix replaces array-based indexing with an explicit byte-offset calculation that respects the device-specific event size before casting to the touch structure. This is a boundary condition and input validation defect in kernel driver code [CWE-1285].

Root Cause

The root cause is a mismatch between the on-wire event size (6 bytes for MMS134S and MMS136) and the compile-time size of struct mms114_touch (8 bytes) used for pointer arithmetic. The driver assumed a single event layout across all supported controllers.

Attack Vector

Exploitation requires the presence of an MMS134S or MMS136 touch controller connected via I2C. The flaw is triggered during normal touch input processing rather than through a network vector. The primary observable effect is incorrect parsing of touch events, which can lead to reads past the intended event slot within the touch buffer and unreliable input behavior.

The upstream fixes are tracked across the following stable-tree commits: 112666835071, 75b12874b4, 7c00a0787a, a6ac4e24c1, and a747c4eb02.

Detection Methods for CVE-2026-64272

Indicators of Compromise

Kernel log messages from the mms114 driver reporting anomalous coordinates or unexpected finger identifiers on devices using MMS134S or MMS136 controllers.
Erratic touchscreen behavior such as ghost touches, missing multi-touch points, or coordinate drift on affected hardware.

Detection Strategies

Inventory Linux-based endpoints and embedded devices to identify systems running kernels with the unpatched mms114 driver and Melfas MMS134S or MMS136 hardware.
Compare installed kernel versions and driver commit hashes against the fixed commits (112666835071, 75b12874b4, 7c00a0787a, a6ac4e24c1, a747c4eb02) referenced in the stable tree.

Monitoring Recommendations

Collect dmesg and journalctl -k output from suspected devices and alert on repeated mms114 parse warnings or input subsystem errors.
Track kernel package versions across the Linux fleet in a centralized inventory to confirm patched builds have been deployed to devices with Melfas touch controllers.

How to Mitigate CVE-2026-64272

Immediate Actions Required

Update to a Linux kernel release that includes one of the fix commits: 112666835071, 75b12874b4, 7c00a0787a, a6ac4e24c1, or a747c4eb02.
Prioritize deployment on embedded Linux and mobile devices confirmed to use the MMS134S or MMS136 touch controllers.
Validate touchscreen input behavior after patching to confirm correct multi-touch event parsing.

Patch Information

The fix modifies the mms114 driver to compute the byte offset of each touch event using the device-specific event size rather than relying on struct mms114_touch array indexing. Refer to the upstream commits: Kernel Patch Commit 112666835071, Kernel Patch Commit 75b12874b4, Kernel Patch Commit 7c00a0787a, Kernel Patch Commit a6ac4e24c1, and Kernel Patch Commit a747c4eb02.

Workarounds

No supported software workaround exists; hardware using MMS134S or MMS136 controllers requires the driver fix to parse touch events correctly.
On non-production devices, disabling the mms114 module removes the faulty behavior at the cost of losing touchscreen functionality.

bash

# Verify running kernel and mms114 module status
uname -r
modinfo mms114 | grep -E 'filename|version|srcversion'

# Optional: unload the driver on test devices where touch input is not required
sudo modprobe -r mms114