CyberSecBulletin
CVE-2026-64364NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64364 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 12e90656e330ff8bbaf2f29c535fdb8a11cc6f55, 152983d87387f6a8ae72b73474cfa55fbcf1ec75, b5c037d6b807017e74a115288f81bc9cd5a5aab8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.36% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 12e90656e330ff8bbaf2f29c535fdb8a11cc6f55 or 152983d87387f6a8ae72b73474cfa55fbcf1ec75 or b5c037d6b807017e74a115288f81bc9cd5a5aab8 or a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxfc488f675344931ffab6a51c43691065ec006567 up to, but not including, 12e90656e330ff8bbaf2f29c535fdb8a11cc6f55; 77711d850bed75ae7142c3d1f22c1a8b4d049c33 up to, but not including, 152983d87387f6a8ae72b73474cfa55fbcf1ec75; 6acfe25968913788d30ec0eedd80178c4ea3f1d0 up to, but not including, b5c037d6b807017e74a115288f81bc9cd5a5aab8; d280c138e66be87d1fccfed42593f02fdb893905 up to, but not including, a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d; f32fea4c0234c971c12e46d76612cdc2dd4bb046 up to, but not including, e24918ee67c4dc3d20d4670750e46e9b160365f4; 46f781e0d151844589dc2125c8cce3300546f92a up to, but not including, 37daa8c96bd563d03150e23f094cb60703594a6d; 46f781e0d151844589dc2125c8cce3300546f92a up to, but not including, 6493ebf9489efef0105078377b973ab33d51af22; 46f781e0d151844589dc2125c8cce3300546f92a up to, but not including, 8813b0612275cc61fe9e6603d0ee019247ade6be; and 8 more ranges12e90656e330ff8bbaf2f29c535fdb8a11cc6f55, 152983d87387f6a8ae72b73474cfa55fbcf1ec75, b5c037d6b807017e74a115288f81bc9cd5a5aab8, a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d, e24918ee67c4dc3d20d4670750e46e9b160365f4, 37daa8c96bd563d03150e23f094cb60703594a6d
LinuxLinux Kernel5.10.246 up to, but not including, 5.10.261; 5.15.196 up to, but not including, 5.15.212; 6.1.158 up to, but not including, 6.1.178; 6.6.114 up to, but not including, 6.6.145; 6.12.55 up to, but not including, 6.12.97; 6.17.5 up to, but not including, 6.18; 6.18.1 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.4; and 2 more ranges5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG. As a result, a multitouch device that advertises a large contact count makes set_bit()/clear_bit() operate past the mt_io_flags word and corrupt the adjacent members of struct mt_device. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs for (i = 0; i < mt->num_slots; i++) clear_bit(i, &td->mt_io_flags); with num_slots == maxcontacts. For maxcontacts around 250 the loop clears the bits that overlap td->applications.next, zeroing that list head, and the list_for_each_entry() that immediately follows then dereferences NULL. The kernel panics from timer (softirq) context. On a KASAN build this shows up as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, which is offsetof(struct mt_application, num_received). The state is reachable from an untrusted USB or Bluetooth HID multitouch device; no local privileges are required. Store the per-slot active state in a separately allocated bitmap sized for maxcontacts, the same pattern already used for pending_palm_slots, and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two "mt_io_flags & MT_IO_SLOTS_MASK" arming checks become bitmap_empty(td->active_slots, td->maxcontacts). Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the same commit to leave the low byte for the slot bits; with the slot bits gone it fits in bit 0 again, which also keeps it within the unsigned long on 32-bit.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.