Linux aws: In the Linux kernel, the following vulnerability has been resolved: Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem When a… (CVE-2026-63908)

The Linux kernel's atmel_mxt_ts driver had a boundary check error in the mxt_prepare_cfg_mem function. When a configuration file specified an object size larger than the driver's known mxt_obj_size(object), the code intended to skip processing extra bytes. However, the condition used (if i > mxt_obj_size(object)) was incorrect because i is zero-based, allowing processing of one byte beyond the valid range. This caused a single byte overwrite of adjacent memory. The fix updated the condition to use >= to correctly skip extra bytes. This vulnerability affects linux-aws kernel versions prior to 7.0.0-28.28~24.04.1 and related versions. The issue is addressed in official Ubuntu kernel updates.

The vulnerability allows a single byte overwrite beyond the boundary of a configuration object in the atmel_mxt_ts driver. This could potentially corrupt adjacent memory or data structures within the kernel, which might lead to system instability or other unintended behavior. No known exploits are reported in the wild. The impact is considered medium severity.

An official patch is available and included in updated linux-aws kernel packages. Users should apply the latest kernel updates provided by their Linux distribution and reboot the system to ensure the fix is applied. No additional mitigation steps are required beyond applying the official update.