The Linux kernel mms114 driver reads touch data packets from a device into a fixed-size on-stack buffer designed to hold 80 bytes (10 events × 8 bytes each). The packet size is read from a device register as a single byte and only checked to be greater than zero, but not bounded against the buffer size. A malicious or malfunctioning device can report a packet size up to 255 bytes, causing the __mms114_read_reg() function to write up to 175 bytes beyond the buffer on the IRQ thread stack. This stack out-of-bounds write can overwrite the stack canary, saved registers, and return address, potentially leading to arbitrary code execution or kernel corruption. The fix involves rejecting packets that exceed the buffer size and dropping such reports, consistent with existing error handling.

This vulnerability allows a stack buffer overflow in the Linux kernel's mms114 driver, which can corrupt kernel stack memory including the stack canary and return address. This corruption could be exploited to execute arbitrary code with kernel privileges or cause a denial of service by crashing the kernel. The vulnerability requires a malicious or malfunctioning device or attacker with the ability to tamper with the I2C bus to report an oversized packet size.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects oversized packets and drops the report instead of reading past the buffer. Until an official patch is confirmed, avoid using untrusted or counterfeit devices that interact with the mms114 driver and monitor vendor advisories for updates.