The Linux kernel HID multitouch driver had a vulnerability where mt_io_flags, a single unsigned long, was incorrectly used as a per-slot bitmap indexed by slot numbers up to 255, exceeding the bit width of mt_io_flags. This caused set_bit() and clear_bit() operations to write beyond the bounds of mt_io_flags, corrupting adjacent struct mt_device members. Specifically, clearing bits for a large number of slots could zero out a list head, causing a null pointer dereference and kernel panic in timer (softirq) context. The flaw is reachable from untrusted USB or Bluetooth HID multitouch devices without local privilege requirements. The fix involves storing per-slot active state in a properly sized bitmap and limiting mt_io_flags to only MT_IO_FLAGS_RUNNING, preventing out-of-bounds access.

An attacker controlling a malicious USB or Bluetooth HID multitouch device can trigger out-of-bounds memory writes in the kernel, leading to memory corruption and a kernel panic. This results in denial of service due to system crashes. No local privileges are required to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix has been implemented in the Linux kernel source by changing the data structure usage to prevent out-of-bounds access. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available.