What is the CVSS score of CVE-2026-64271?

CVE-2026-64271 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64271?

A Linux kernel vulnerability affecting Touchwindow touchscreen devices could enable local privilege escalation; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-64271?

Within 24 hours, identify Linux systems in the environment using Touchwindow touchscreen devices-particularly kiosks, ATMs, point-of-sale terminals, or industrial control systems. Within 7 days, plan and schedule kernel upgrades to patched versions (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, or 7.1.4 depending on deployed kernel series). Complete the upgrade within 30 days; if immediate patching is not feasible, disable or physically disconnect the Touchwindow peripheral to eliminate the attack vector.

Linux Kernel CVE-2026-64271

EUVD-2026-48983 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-25 Linux

GHSA-v33c-vvwm-9mr7

Buffer Overflow Linux

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

Attack requires physical peripheral connection (AV:P over NVD's AV:L); the malicious device drives kernel interrupts directly, requiring no user account (PR:N).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 18:39 vuln.today

CVSS changed

Aug 13, 2026 - 18:37 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 nvd

HIGH 7.8

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Input: touchwin - reset the packet index on every complete packet

tw_interrupt() accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received *and* the device's two Y bytes agree:

tw->data[tw->idx++] = data; if (tw->idx TW_LENGTH && tw->data[1] tw->data[2]) { ... tw->idx = 0; }

The reset is gated on tw->data[1] == tw->data[2], a value the device controls. A malicious, malfunctioning or counterfeit Touchwindow peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the index reaches TW_LENGTH without the equality holding, is never reset, and keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte array and the rest of the heap-allocated struct tw, one attacker-chosen byte at a time -- an unbounded, device-driven heap out-of-bounds write.

Reset the index on every completed packet and report an event only when the two Y bytes match, like the other serio touchscreen drivers do.

AnalysisAI

Heap out-of-bounds write in the Linux kernel's touchwin serial touchscreen driver allows a malicious, malfunctioning, or counterfeit Touchwindow peripheral to corrupt kernel heap memory one attacker-chosen byte at a time, potentially enabling local privilege escalation or kernel crash. The flaw exists since Linux 2.6.19 and affects all stable branches through 7.1.3 and pre-7.2-rc1; patched versions have been released across six stable series (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4). EPSS is 0.22% (13th percentile) and no public exploit or CISA KEV listing has been identified, reflecting the niche hardware prerequisite that sharply limits real-world exposure.

Technical ContextAI

The touchwin driver (drivers/input/touchscreen/touchwin.c) implements a serio-based protocol handler for the legacy Touchwindow serial touchscreen. Its interrupt handler tw_interrupt() accumulates incoming non-zero serial bytes into a fixed three-byte array tw->data[TW_LENGTH] using a running index tw->idx. The root cause is CWE-129 (Improper Validation of Array Index): index reset is gated on the device-controlled equality check tw->data[1] == tw->data[2]. A malicious peripheral that consistently streams packets where these two bytes differ will cause tw->idx to reach TW_LENGTH without ever being cleared, then continue incrementing unchecked - writing attacker-chosen bytes sequentially past the array boundary into adjacent kernel heap memory hosting the remainder of the kmalloc'd struct tw. The write is unbounded and device-paced, making it a controllable heap overwrite primitive. The serio subsystem processes these bytes in interrupt context, meaning no sleeping lock or user-space mediation stands between the peripheral and the vulnerable write path. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all Linux kernel versions.

RemediationAI

Apply the upstream stable kernel patch for the series in use: upgrade to Linux 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 or later; fix commits are available at https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508 (and the parallel branch commits listed in the references). If kernel upgrade cannot be performed immediately and Touchwindow hardware is not in active use, blacklist the driver by adding the line 'blacklist touchwin' to /etc/modprobe.d/blacklist.conf and running 'update-initramfs -u' (Debian/Ubuntu) or 'dracut --force' (RHEL/SUSE) to persist the change across reboots; this eliminates the attack surface entirely on systems not relying on this hardware with no functional side effects. If the Touchwindow device is required for production use, apply strict physical port access controls (lock the serial/USB port housing) to prevent substitution with a malicious peripheral, and prioritize scheduling the kernel update. Distribution-level advisories (RHSA, DSA, etc.) have not yet appeared in the reference set and should be monitored independently.

Same weakness CWE-129 – Improper Validation of Array Index

View all

CVE-2016-9053 CRITICAL POC

9.8

CVE-2020-27485 CRITICAL POC

9.9

CVE-2020-27483 CRITICAL POC

9.9

CVE-2024-24563 CRITICAL POC

9.8

CVE-2017-8797 HIGH

7.5

CVE-2018-11489 HIGH POC

8.8

CVE-2026-56770 HIGH POC

8.7

CVE-2017-7228 HIGH POC

8.2

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64271 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64271

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-129 – Improper Validation of Array Index

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code