CVE-2026-64270

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack out-of-bounds write exists in the mms114 interrupt() function. The function reads touch data from a device into a fixed-size on-stack buffer touch[] that holds 80 bytes. Because the packet size variable is taken directly from the device without being bounded against the buffer size, a malicious or malfunctioning controller can report a packet size up to 255. This allows the mms114 read reg() function to write up to 175 bytes beyond the end of the buffer on the IRQ-thread stack, potentially overwriting the stack canary, saved registers, and the return address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.