CVE-2026-64364

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds bit access exists in the HID multitouch subsystem. The mt io flags variable is treated as a per-slot bitmap indexed by a slot number that can be as high as 255, based on the device's ContactCountMaximum report, exceeding the capacity of a single unsigned long. This allows a malicious USB or Bluetooth HID multitouch device to cause set bit() or clear bit() to operate beyond the mt io flags boundary, corrupting adjacent members of the mt device structure. Specifically, the mt release contacts() function may zero out the td->applications.next list head, leading to a null-pointer dereference and a kernel panic. This state can be triggered by an untrusted device without requiring local privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.