CVE-2026-64364

Estado: AnalizadaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: fix out-of-bounds bit access on mt_io_flags

mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG.

As a result, a multitouch device that advertises a large contact count makes set_bit()/clear_bit() operate past the mt_io_flags word and corrupt the adjacent members of struct mt_device. The sticky-fingers release timer is the easiest way to reach this. mt_release_contacts() runs

Leer descripción completaMostrar menos

with num_slots == maxcontacts. For maxcontacts around 250 the loop clears the bits that overlap td->applications.next, zeroing that list head, and the list_for_each_entry() that immediately follows then dereferences NULL. The kernel panics from timer (softirq) context. On a KASAN build this shows up as a general protection fault in mt_release_contacts() with a null-ptr-deref at offset 0x58, which is offsetof(struct mt_application, num_received).

The state is reachable from an untrusted USB or Bluetooth HID multitouch device; no local privileges are required.

Store the per-slot active state in a separately allocated bitmap sized for maxcontacts, the same pattern already used for pending_palm_slots, and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two "mt_io_flags & MT_IO_SLOTS_MASK" arming checks become bitmap_empty(td->active_slots, td->maxcontacts).

Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the same commit to leave the low byte for the slot bits; with the slot bits gone it fits in bit 0 again, which also keeps it within the unsigned long on 32-bit.

Detalles técnicos trazas, registros y código del informe original

	for (i = 0; i < mt->num_slots; i++)
		clear_bit(i, &td->mt_io_flags);

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.35%
Percentil entre todas las CVEs puntuadas: 27
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation75 %

Dispositivo HID USB/Bluetooth no confiable (AV:A, red adyacente, sin privilegios PR:N) explota corrupción de memoria en núcleo Linux. Impacto: DoS por panic desde contexto softirq; potencial escalada al ejecutarse en contexto kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning Privileged Account Management

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-125

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-64364",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "fc488f675344931ffab6a51c43691065ec006567",
              "lessThan": "12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77711d850bed75ae7142c3d1f22c1a8b4d049c33",
              "lessThan": "152983d87387f6a8ae72b73474cfa55fbcf1ec75",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6acfe25968913788d30ec0eedd80178c4ea3f1d0",
              "lessThan": "b5c037d6b807017e74a115288f81bc9cd5a5aab8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d280c138e66be87d1fccfed42593f02fdb893905",
              "lessThan": "a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f32fea4c0234c971c12e46d76612cdc2dd4bb046",
              "lessThan": "e24918ee67c4dc3d20d4670750e46e9b160365f4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "lessThan": "37daa8c96bd563d03150e23f094cb60703594a6d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "lessThan": "6493ebf9489efef0105078377b973ab33d51af22",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "lessThan": "8813b0612275cc61fe9e6603d0ee019247ade6be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "59bd04163e6451b9c7275277882ed9f4abfa2051",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.10.246",
              "lessThan": "5.10.261",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.196",
              "lessThan": "5.15.212",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.1.158",
              "lessThan": "6.1.178",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.6.114",
              "lessThan": "6.6.145",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.12.55",
              "lessThan": "6.12.97",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.17.5",
              "lessThan": "6.18",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-25T10:17:19.110",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td->maxcontacts, which is taken from the device's\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i < mt->num_slots; i++)\n\t\tclear_bit(i, &td->mt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td->applications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags & MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td->active_slots, td->maxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."
    }
  ],
  "lastModified": "2026-09-10T21:35:45.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72CE0BCB-E931-4062-AEC1-BD286F06EFD2",
              "versionEndExcluding": "5.10.261",
              "versionStartIncluding": "5.10.246"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35A42A8C-A02C-4A52-A27B-31BF30340A35",
              "versionEndExcluding": "5.15.212",
              "versionStartIncluding": "5.15.196"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0E35CD9-BE71-41CE-BEAA-F257DDE46494",
              "versionEndExcluding": "6.1.178",
              "versionStartIncluding": "6.1.158"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E29121D8-3A72-421B-AA20-A66AF9E033DE",
              "versionEndExcluding": "6.6.145",
              "versionStartIncluding": "6.6.114"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83DF16B7-EB70-4279-82FC-17A8CCF3F8CC",
              "versionEndExcluding": "6.12.97",
              "versionStartIncluding": "6.12.55"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27929282-2519-484B-B04C-5B62B31FBC5E",
              "versionEndExcluding": "6.18",
              "versionStartIncluding": "6.17.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F64A7C83-15C4-42D8-97A5-F14BB7E7220D",
              "versionEndExcluding": "6.18.39",
              "versionStartIncluding": "6.18.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}