In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C… (CVE-2026-64275)
In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces or y_traces, it results in a fatal division-by-zero exception leading to a kernel panic during device probe. Add checks to ensure these parameters are non-zero before performing the division. If invalid trace values are detected, fall back to a safe default of 1. Additionally, prevent an arithmetic underflow in the touch reporting logic. Previously, if the calculated or fallback width was smaller than ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a massive unsigned integer being reported to userspace. Clamp the adjusted width to a minimum of 0 to safely handle small physical dimensions and fallback scenarios. Completing the probe with safe fallback values ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device.
AI Analysis
Technical Summary
The Linux kernel's Elan I2C touchpad driver queries device physical dimensions and trace counts to calculate resolution and width. If the device firmware or device tree reports zero for x_traces or y_traces, a division-by-zero occurs causing a kernel panic during device probe. Additionally, an arithmetic underflow can occur if the calculated width is smaller than a defined threshold, resulting in an invalid large unsigned integer reported to userspace. The fix adds validation to ensure these parameters are non-zero, falling back to a safe default of 1, and clamps the adjusted width to a minimum of 0. This prevents kernel panics and ensures sysfs nodes are created to allow firmware recovery.
Potential Impact
Exploitation of this vulnerability causes a fatal kernel panic during device probing, leading to system instability or denial of service. The kernel panic occurs due to division by zero and arithmetic underflow when invalid zero values are provided by device firmware or device tree. This disrupts normal operation and could prevent the device from functioning properly until recovery firmware is applied.
Mitigation Recommendations
A fix has been implemented that adds checks to prevent division by zero and arithmetic underflow in the Elan I2C touchpad driver. Systems should apply the official Linux kernel update containing this fix once available. Until patched, avoid using devices with firmware or device tree configurations that provide zero values for x_traces or y_traces. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C… (CVE-2026-64275)
Description
In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces or y_traces, it results in a fatal division-by-zero exception leading to a kernel panic during device probe. Add checks to ensure these parameters are non-zero before performing the division. If invalid trace values are detected, fall back to a safe default of 1. Additionally, prevent an arithmetic underflow in the touch reporting logic. Previously, if the calculated or fallback width was smaller than ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a massive unsigned integer being reported to userspace. Clamp the adjusted width to a minimum of 0 to safely handle small physical dimensions and fallback scenarios. Completing the probe with safe fallback values ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's Elan I2C touchpad driver queries device physical dimensions and trace counts to calculate resolution and width. If the device firmware or device tree reports zero for x_traces or y_traces, a division-by-zero occurs causing a kernel panic during device probe. Additionally, an arithmetic underflow can occur if the calculated width is smaller than a defined threshold, resulting in an invalid large unsigned integer reported to userspace. The fix adds validation to ensure these parameters are non-zero, falling back to a safe default of 1, and clamps the adjusted width to a minimum of 0. This prevents kernel panics and ensures sysfs nodes are created to allow firmware recovery.
Potential Impact
Exploitation of this vulnerability causes a fatal kernel panic during device probing, leading to system instability or denial of service. The kernel panic occurs due to division by zero and arithmetic underflow when invalid zero values are provided by device firmware or device tree. This disrupts normal operation and could prevent the device from functioning properly until recovery firmware is applied.
Mitigation Recommendations
A fix has been implemented that adds checks to prevent division by zero and arithmetic underflow in the Elan I2C touchpad driver. Systems should apply the official Linux kernel update containing this fix once available. Until patched, avoid using devices with firmware or device tree configurations that provide zero values for x_traces or y_traces. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-742p-q3m8-x43j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64275"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420f9c2644c7f8086913
Added to database: 07/25/2026, 23:09:03 UTC
Last enriched: 07/25/2026, 23:42:47 UTC
Last updated: 09/07/2026, 22:52:14 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.