CVE-2026-64271

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap out-of-bounds write exists in the tw interrupt() function. The function accumulates non-zero serial bytes into a fixed three-byte buffer using a running index tw->idx. This index is only reset when a full packet is received and the device's two Y bytes match. A malicious or malfunctioning Touchwindow peripheral can send bytes where the second and third bytes differ, preventing the index from resetting. Consequently, the index continues to increase, allowing the tw->data[tw->idx++] operation to write beyond the buffer and into the heap-allocated tw structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.