What is the CVSS score of CVE-2026-64367?

CVE-2026-64367 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64367?

The Linux kernel's hid-goodix-spi driver contains a local privilege escalation vulnerability (CVE-2026-64367, CVSS 7.8) affecting systems with Goodix SPI HID touchpads.. A patch is available.

How to fix or mitigate CVE-2026-64367?

Within 24 hours, inventory Linux systems with Goodix SPI HID devices (commonly found in specific laptop and embedded device models) and determine scope of exposure. Within 7 days, obtain the patched Linux kernel version from your distribution vendor and validate it in a staging environment matching your production kernel configurations. Within 30 days, deploy the kernel patch across all affected systems and reboot to activate; prioritize systems where non-privileged users have direct access to hidraw device nodes.

Linux Kernel CVE-2026-64367

EUVD-2026-48911 HIGH

Out-of-bounds Write (CWE-787)

2026-07-25 Linux

GHSA-p4f3-xcv2-3qcx

Buffer Overflow Linux Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access to the hidraw device node (AV:L, PR:L) with a trivially crafted oversized report (AC:L) causes kernel stack corruption yielding full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:39 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:50 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:50 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-goodix-spi: validate report size to prevent stack buffer overflow

goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set hid_ll_driver.max_buffer_size and performs no bounds checking before copying the payload:

memcpy(tmp_buf + tx_len, buf, len);

A hidraw SET_REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer.

Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

AnalysisAI

Local privilege escalation via stack buffer overflow in the Linux kernel's hid-goodix-spi driver allows a user with access to a Goodix SPI HID device node to corrupt kernel stack memory and achieve full system compromise. The goodix_hid_set_raw_report() function copies caller-supplied report data into a fixed 128-byte stack buffer without bounds checking, so a hidraw SET_REPORT ioctl carrying more than ~116 bytes overflows it. There is no public exploit identified at time of analysis, and the low EPSS score (0.23%) plus the local-only, hardware-specific attack surface indicate limited real-world exposure despite the high 7.8 CVSS.

Technical ContextAI

The flaw resides in drivers/hid/hid-goodix-spi.c, the kernel driver for Goodix touch controllers connected over SPI that expose an HID interface (typically touchscreens/touchpads in laptops and tablets). goodix_hid_set_raw_report() constructs an 11-12 byte protocol header in a 128-byte on-stack scratch buffer (tmp_buf) and then appends the report payload via memcpy(tmp_buf + tx_len, buf, len). Because the driver never sets hid_ll_driver.max_buffer_size, the HID core permits report sizes up to HID_MAX_BUFFER_SIZE (16384 bytes), while the driver itself performs no length validation before the copy. This is a classic CWE-121 stack-based buffer overflow (CWE-787 out-of-bounds write); the missing bound between the HID core's 16KB cap and the driver's 128-byte buffer is the root cause. CPE data lists cpe:2.3:a:linux:linux, confirming the Linux kernel as the affected package.

RemediationAI

Vendor-released patch: update to a fixed Linux stable kernel - 6.12.96, 6.18.39, 7.1.4, or mainline 7.2-rc1 (fix commits ad47ad62, dae1d000, 835fcc86, db0a0768 at git.kernel.org), which adds a size check after header construction to reject reports exceeding the tmp_buf capacity. Most users should take the fix through their distribution's kernel update. If immediate patching is not possible, the practical compensating control is to restrict access to the affected hidraw device nodes: tighten permissions/udev rules on /dev/hidrawX so only trusted processes can issue SET_REPORT ioctls, or unload/blacklist the hid-goodix-spi module on systems that do not require Goodix SPI touch input - note that blacklisting will disable the affected touchscreen/touchpad, so this is only viable where that input device is unused.

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64367 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64367

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-787 – Out-of-bounds Write

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code