The Linux kernel usbtouchscreen driver for NEXIO devices reads data_len and x_len fields from a packed 16-bit header in device interrupt packets. These lengths can be up to 65535, but the USB buffer allocated is only 1024 bytes (with 1017 bytes for data). The existing code only slightly adjusts these lengths, allowing the read loop to access memory far beyond the buffer. This results in an out-of-bounds read that leaks kernel memory contents to userspace through ABS_X and ABS_Y events or causes a kernel fault if accessing unmapped pages. The vulnerability is resolved by clamping data_len and x_len to the actual buffer size to prevent out-of-bounds access.

An attacker controlling a malicious NEXIO USB touchscreen device can exploit this vulnerability to leak kernel memory contents to userspace, potentially exposing sensitive information. Additionally, the out-of-bounds read can cause a kernel fault, leading to denial of service. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves clamping the data_len and x_len fields to the USB buffer size to prevent out-of-bounds reads. Until an official patch is applied, avoid using untrusted NEXIO USB touchscreen devices or restrict their access.