CVE-2026-64014

In the Linux kernel, the following vulnerability has been resolved:

Input: usbtouchscreen - clamp NEXIO datalen/xlen to URB buffer size

nexioreaddata() pulls datalen and xlen from a packed _be16 header in the device's interrupt packet and then walks packet->data[0..xlen) and packet->data[xlen..datalen) comparing each byte against a threshold.

Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is reptsize (1024) bytes from usballoccoherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. readdata() callbacks are not given urb->actual_length, and nothing else bounds the walk.

A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIOTHRESHOLD lands in beginx / beginy and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABSX / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault.

Fix this all by clamping datalen to the buffer's data[] capacity and xlen to data_len.