CVE-2026-64364: Linux Kernel Privilege Escalation Flaw

CVE-2026-64364 Overview

CVE-2026-64364 is an out-of-bounds write vulnerability in the Linux kernel's HID multitouch driver (hid-multitouch). The flaw resides in how mt_io_flags, a single unsigned long, is misused as a per-slot bitmap indexed by contact slot number. Because the slot count is bounded only by the device's ContactCountMaximum feature report (up to 255) rather than BITS_PER_LONG, a malicious multitouch device can trigger set_bit() and clear_bit() operations that write past the mt_io_flags word and corrupt adjacent members of struct mt_device.

Critical Impact
An untrusted USB or Bluetooth HID multitouch device that advertises a large contact count can corrupt kernel memory, causing a NULL pointer dereference in softirq context and a kernel panic. No local privileges are required.

Affected Products

Linux kernel versions containing the vulnerable hid-multitouch driver prior to the fix commits
Systems accepting USB HID multitouch devices
Systems accepting Bluetooth HID multitouch devices

Discovery Timeline

2026-07-25 - CVE-2026-64364 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64364

Vulnerability Analysis

The hid-multitouch driver tracks per-slot state using bit operations on td->mt_io_flags, a single unsigned long. Functions mt_process_slot(), mt_release_pending_palms(), and mt_release_contacts() index into this word using the raw contact slot number. Slot numbers derive from the device-supplied ContactCountMaximum field and can reach 255, well beyond the 32 or 64 bits available in an unsigned long.

The sticky-fingers release timer provides the most direct path to exploitation. mt_release_contacts() iterates from 0 to mt->num_slots calling clear_bit(i, &td->mt_io_flags). When maxcontacts approaches 250, the loop clears bits overlapping td->applications.next, zeroing that list_head. The subsequent list_for_each_entry() then dereferences NULL from softirq context, panicking the kernel.

On KASAN builds the fault surfaces as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, matching offsetof(struct mt_application, num_received).

Root Cause

The root cause is an out-of-bounds bit access driven by attacker-controlled input. The driver assumes slot indices fit within BITS_PER_LONG but never enforces that bound. Any contact count derived from the untrusted HID feature report is used directly as a bit index into a fixed-size flag word.

Attack Vector

An attacker connects a crafted USB or Bluetooth HID multitouch device that advertises a ContactCountMaximum value large enough to push slot indices past the size of mt_io_flags. When the driver invokes mt_release_contacts() from the sticky-fingers timer, the resulting out-of-bounds clear_bit() corrupts adjacent struct mt_device members and triggers a kernel panic. The attack requires physical or adjacent-network proximity but no user authentication.

Refer to the upstream fix commits for the exact code change: Kernel Patch 12e9065 and Kernel Patch b5c037d.

Detection Methods for CVE-2026-64364

Indicators of Compromise

Unexpected kernel panics or general protection faults originating in mt_release_contacts() or related hid-multitouch functions
KASAN reports flagging null-ptr-deref at offset 0x58 within struct mt_application
HID device enumeration events showing multitouch devices reporting unusually high ContactCountMaximum values (approaching 255)

Detection Strategies

Monitor dmesg and kernel crash logs for oops or panic signatures referencing hid-multitouch, mt_release_contacts, or mt_process_slot
Correlate USB and Bluetooth HID connection events with subsequent kernel instability on the same host
Deploy KASAN or KFENCE on test fleets to surface out-of-bounds writes in the HID subsystem before production impact

Monitoring Recommendations

Alert on repeated HID device attach events from unknown vendors on endpoints and shared workstations
Track kernel crash telemetry across the fleet and prioritize hosts running unpatched kernel versions
Log Bluetooth pairing attempts and USB device insertions in environments where physical access is not tightly controlled

How to Mitigate CVE-2026-64364

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable tree commits and rebuild or update to a fixed kernel package from your distribution
Restrict physical and Bluetooth access on high-value systems until patched kernels are deployed
Inventory endpoints, servers, and embedded Linux devices that expose USB or Bluetooth HID interfaces

Patch Information

The fix stores per-slot active state in a separately allocated bitmap sized for maxcontacts, mirroring the existing pending_palm_slots pattern, and keeps only MT_IO_FLAGS_RUNNING in mt_io_flags. Arming checks change from mt_io_flags & MT_IO_SLOTS_MASK to bitmap_empty(td->active_slots, td->maxcontacts). MT_IO_FLAGS_RUNNING returns to bit 0 so it fits within an unsigned long on 32-bit systems. Corresponding stable-tree commits include Kernel Patch 12e9065, Kernel Patch 152983d, Kernel Patch 37daa8c, Kernel Patch 6493ebf, Kernel Patch 8813b06, Kernel Patch a6d5ce2, Kernel Patch b5c037d, and Kernel Patch e24918e.

Workarounds

Blacklist the hid_multitouch kernel module on systems that do not require multitouch input
Disable Bluetooth HID profiles on servers and infrastructure hosts where they are not needed
Enforce USB device allowlisting through USBGuard or equivalent controls to block untrusted HID devices

bash

# Blacklist the vulnerable module until patching is complete
echo 'blacklist hid_multitouch' | sudo tee /etc/modprobe.d/blacklist-hid-multitouch.conf
sudo rmmod hid_multitouch 2>/dev/null || true
sudo update-initramfs -u