CVE-2026-64271: Linux kernel · Input: touchwin – reset the packet index on every complete packet
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ed9b66905407eb3d02df1aaeed82eb7a7f0eb508 : patch Linux kernel soon.
Data as of 6 Nov 2026, 16:51 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in ed9b66905407eb3d02df1aaeed82eb7a7f0eb508, a8d87184576c889759e3aab899799a482f1e1a5b, 044167cba2384bcd783547ad5e30ecd292b30919 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in the Linux kernel. The patch resets the packet index on every completed packet instead of gating it on device-controlled byte equality. Users should update to a Linux kernel version that includes the fix identified by the provided commit hashes. No additional mitigation is indicated.
Description
A vulnerability in the Linux kernel's touchwin input driver allows a malicious or counterfeit Touchwindow peripheral to cause an unbounded heap out-of-bounds write by manipulating the packet index reset logic. The flaw arises because the packet index is only reset when two device-controlled bytes match, enabling an attacker to overflow a fixed three-byte buffer by sending crafted data packets.
References
- git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508 (opens in a new tab)
- git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919 (opens in a new tab)
- git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1 (opens in a new tab)
- git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185 (opens in a new tab)
- git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36 (opens in a new tab)
- git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672 (opens in a new tab)
- git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b (opens in a new tab)
- git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94 (opens in a new tab)