CVE-2026-64364 is a vulnerability in the Linux kernel's HID multitouch driver where mt_io_flags, a single unsigned long, was used incorrectly as a per-slot bitmap indexed by the slot number. The slot number is bounded by the device's ContactCountMaximum feature report (up to 255), which exceeds the bit width of mt_io_flags (BITS_PER_LONG). This results in out-of-bounds bit operations (set_bit/clear_bit) that corrupt adjacent memory in struct mt_device. The flaw can be triggered by multitouch devices advertising large contact counts, leading to memory corruption and potential system compromise. The vulnerability has been resolved in Linux kernel updates.

The vulnerability allows an attacker with access to a multitouch device that reports a large number of contacts to cause out-of-bounds bit operations, corrupting adjacent kernel memory structures. This memory corruption can lead to system instability, denial of service, or potentially privilege escalation. The CVSS score of 8.8 indicates high impact with high confidentiality, integrity, and availability impact. No known exploits in the wild have been reported.

A patch is available and should be applied by updating to the fixed Linux kernel versions as provided by the vendor. The Ubuntu security advisories USN-8726-1 and USN-8727-1 detail the fixed package versions. After updating, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation is required beyond applying the official kernel updates.