CVE-2026-64275 Overview
CVE-2026-64275 is a Linux kernel vulnerability in the Elan I2C touchpad driver (elan_i2c). The driver queries the device for its physical dimensions and trace counts to calculate resolution and width. When the device firmware or device tree returns zero values for x_traces or y_traces, the driver triggers a division-by-zero exception during device probe. This results in a kernel panic. A related arithmetic underflow can also occur in the touch reporting logic when the calculated width is smaller than the ETP_FWIDTH_REDUCE constant (90), producing a large unsigned integer reported to userspace.
Critical Impact
A malformed or malfunctioning Elan touchpad device can cause a kernel panic during probe, denying service on affected Linux systems.
Affected Products
- Linux kernel builds including the elan_i2c input driver
- Systems using Elan I2C touchpad hardware with firmware or device tree exposing zero trace counts
- Distributions shipping stable kernels prior to the patch commits referenced below
Discovery Timeline
- 2026-07-25 - CVE-2026-64275 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64275
Vulnerability Analysis
The elan_i2c driver calculates touchpad resolution and width using values retrieved from the device. Two arithmetic issues exist in this calculation path.
First, the driver divides physical dimensions by x_traces and y_traces without validating those operands. When either value is zero, the CPU raises a divide error. In kernel context this becomes a fatal exception, panicking the system during device probe.
Second, the touch reporting logic subtracts the constant ETP_FWIDTH_REDUCE (value 90) from a computed width. When the width is smaller than 90, the subtraction underflows because the type is unsigned. The result is a very large integer reported to userspace, corrupting touch data semantics.
The fix adds guards to ensure the divisors are non-zero, falling back to a safe default of 1 when invalid trace values are detected. It also clamps the adjusted width to a minimum of 0 to handle small physical dimensions and fallback scenarios. Completing the probe with safe fallback values preserves the sysfs nodes so recovery firmware can be flashed to the device.
Root Cause
The root cause is missing input validation on device-supplied parameters. The driver trusts x_traces and y_traces values obtained from firmware or device tree without range checks. The width subtraction operates on unsigned arithmetic without a lower-bound clamp, allowing underflow when input values fall below the reduction constant.
Attack Vector
Exploitation requires a device that reports zero or otherwise malformed trace counts. A malfunctioning touchpad, corrupted firmware, or a crafted device tree entry can trigger the kernel panic during probe. The impact is availability loss through denial of service rather than memory corruption or privilege escalation. No verified public exploit is available. See the referenced kernel git commits for the code-level fix.
Detection Methods for CVE-2026-64275
Indicators of Compromise
- Kernel panic messages referencing elan_i2c during boot or hotplug device probe
- divide error exceptions logged with elan_i2c frames in the stack trace
- Userspace input events from a touchpad reporting abnormally large width values
Detection Strategies
- Review dmesg and journal logs for divide-by-zero faults tied to input subsystem initialization
- Correlate device probe failures with Elan I2C touchpad hardware identifiers on affected endpoints
- Inspect input event streams for width values exceeding physically plausible touchpad dimensions
Monitoring Recommendations
- Ship kernel logs to a central store and alert on divide error or elan_i2c panic patterns
- Track fleet-wide kernel version inventory to identify hosts running unpatched elan_i2c code
- Monitor systems that repeatedly panic at boot, which may indicate a persistent hardware or firmware trigger
How to Mitigate CVE-2026-64275
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the git.kernel.org commits listed in the advisory
- Update to a stable kernel release that includes the elan_i2c fix for both the division-by-zero and the width underflow
- Validate that affected systems boot cleanly after the update, especially those with known-faulty Elan touchpad firmware
Patch Information
The fix is committed to the mainline and stable Linux trees. See the Kernel Git Commit 01e0317c256c, Kernel Git Commit 2f281ff0163a, Kernel Git Commit 59d4cc5e7a97, Kernel Git Commit 6bac57d8fe2a, Kernel Git Commit 8c1db3418a41, Kernel Git Commit df2b818fa009, Kernel Git Commit f6d10af2036d, and Kernel Git Commit feb4866a42ec for the code changes.
Workarounds
- Blacklist the elan_i2c module on systems that panic at boot until a patched kernel is installed
- Where feasible, replace or reflash the touchpad firmware that reports zero trace counts
- Boot with the input device physically disconnected or disabled in firmware to bypass the faulting probe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
