Skip to main content

Linux Kernel CVE-2026-64275

| EUVDEUVD-2026-48987 MEDIUM
Divide By Zero (CWE-369)
2026-07-25 Linux GHSA-742p-q3m8-x43j
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector and low privileges align with driver-level probe triggered by hardware or hot-plug; kernel panic yields A:H with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 18:41 vuln.today
CVSS changed
Aug 13, 2026 - 18:37 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Input: elan_i2c - prevent division by zero and arithmetic underflow

The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces or y_traces, it results in a fatal division-by-zero exception leading to a kernel panic during device probe.

Add checks to ensure these parameters are non-zero before performing the division. If invalid trace values are detected, fall back to a safe default of 1.

Additionally, prevent an arithmetic underflow in the touch reporting logic. Previously, if the calculated or fallback width was smaller than ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a massive unsigned integer being reported to userspace. Clamp the adjusted width to a minimum of 0 to safely handle small physical dimensions and fallback scenarios.

Completing the probe with safe fallback values ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device.

AnalysisAI

Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.

Technical ContextAI

CWE-369 (Divide By Zero) applies to the primary issue in the elan_i2c driver, which computes device resolution by dividing physical dimensions by x_traces and y_traces values returned by device firmware or parsed from device tree entries. Zero-value trace counts - whether due to corrupt firmware, hardware defect, or malformed device tree - cause an unguarded integer division by zero during the kernel's probe phase. The secondary issue is a C-language unsigned integer underflow: when the computed width is less than ETP_FWIDTH_REDUCE (the constant 90), subtracting it from a smaller unsigned integer wraps around to a very large value, which is passed through the kernel input layer and reported to userspace. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across all stable branches since the driver was introduced at commit 6696777c6506fa52b2a0282121195843ed855be6, approximately Linux 3.19.

RemediationAI

Update to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1. Individual stable branch patch commits are available at git.kernel.org/stable/c/ (see references for all eight branch-specific commit hashes). For systems that cannot be immediately updated, a compensating control is to blacklist the elan_i2c kernel module by adding 'blacklist elan_i2c' to /etc/modprobe.d/ - this eliminates the kernel panic risk but also disables the Elan touchpad entirely, requiring an external USB mouse as a substitute. On embedded or custom Linux platforms, correcting the device tree source to supply non-zero x_traces and y_traces values eliminates the vulnerability without disabling touchpad functionality. Systems without Elan I2C touchpad hardware where the driver is not loaded are not affected and require no action.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64275 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy