CVE-2026-64271 Input: touchwin - reset the packet index on every complete packet
A malicious Touchwindow peripheral can trigger a heap out-of-bounds write in the Linux kernel touchwin driver, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64271?
CVE-2026-64271 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: touchwin - reset the packet index on every complete packet
tw_interrupt() accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received *and* the device's two Y bytes agree:
tw->data[tw->idx++] = data; if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) { ... tw->idx = 0; }
The reset is gated on tw->data[1] == tw->data[2], a value the device controls. A malicious, malfunctioning or counterfeit Touchwindow peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the index reaches TW_LENGTH without the equality holding, is never reset, and keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte array and the rest of the heap-allocated struct tw, one attacker-chosen byte at a time -- an unbounded, device-driven heap out-of-bounds write.
Reset the index on every completed packet and report an event only when the two Y bytes match, like the other serio touchscreen drivers do.
Weakness: CWE-129
Which versions are affected by CVE-2026-64271?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64271?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64271 being exploited?
There is no known exploitation of CVE-2026-64271 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64271, DEBIAN-CVE-2026-64271, GHSA-v33c-vvwm-9mr7, ROOT-OS-UBUNTU-2204-CVE-2026-64271, UBUNTU-CVE-2026-64271.