CVE-2026-64014

What it actually does

CVE-2026-64014 is an out-of-bounds read in the Linux kernel usbtouchscreen driver’s NEXIO handling path. The driver trusts 16-bit length fields supplied by a USB interrupt packet and iterates over packet data beyond the allocated URB DMA buffer, which is approximately 1024 bytes total with about 1017 bytes usable for payload. A malicious or malformed NEXIO-compatible USB touchscreen device can cause the kernel to read up to roughly 64 KiB past the expected buffer. Bytes read from adjacent kernel memory can influence reported ABS_X and ABS_Y input coordinates, creating a kernel memory disclosure path to userspace. If the out-of-bounds read reaches unmapped memory, it may also trigger a kernel fault and cause local denial of service.

Why it matters to the business

The primary business risk is exposure of sensitive kernel memory through input events on Linux systems that attach or emulate affected NEXIO USB touchscreen devices. In most organizations this is lower likelihood than network-exploitable vulnerabilities because exploitation generally requires physical USB access, malicious peripheral attachment, or control of a USB-emulation path such as a compromised dock, KVM, hypervisor USB passthrough, or embedded device. The operational impact can include workstation or kiosk instability, kernel crashes, and potential leakage of memory contents that may assist further local exploitation. EPSS is low at 0.00177, it is not listed in CISA KEV, and no public exploit maturity is reported, so remediation should be prioritized based on exposure to untrusted USB devices, kiosks, industrial terminals, point-of-sale systems, and environments using USB passthrough.

How an attack unfolds

An attacker presents a malicious USB device that is recognized by Linux as a NEXIO touchscreen handled by the usbtouchscreen driver. The device sends an interrupt packet with crafted data_len and x_len values that are much larger than the actual URB buffer capacity. The vulnerable driver parses those attacker-controlled fields and walks beyond the valid packet data while comparing bytes against a threshold. When bytes from adjacent kernel memory satisfy the comparison, their positions are converted into reported touch coordinates and delivered to userspace as input events such as ABS_X and ABS_Y. By repeatedly sending crafted packets and observing resulting input events, an attacker may infer portions of kernel memory. If the crafted lengths cause the read to reach unmapped memory, the kernel may fault, resulting in a system crash or degraded availability.

How to fix it

Upgrade to a Linux kernel version that includes the fix clamping NEXIO data_len to the packet data buffer capacity and x_len to data_len. If using a distribution kernel, apply the vendor-provided security update rather than attempting to cherry-pick manually. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the usbtouchscreen kernel module on systems that do not require it, restricting physical USB access, disabling unused USB ports in firmware or operating system policy, and avoiding USB passthrough from untrusted hosts or devices. For kiosk, POS, industrial, and shared-access systems, pair patching with USB device allowlisting where supported.

How to confirm the fix worked

Confirm that systems are running a kernel build containing the usbtouchscreen NEXIO bounds-checking fix. Validate package status through the operating system’s package manager and vendor advisory metadata, then confirm the running kernel matches the updated installed kernel after reboot. Check whether the usbtouchscreen module is loaded with commands such as lsmod and whether NEXIO-like USB touchscreen devices are present via USB inventory tools. For mitigation validation, verify that the module cannot be loaded when blacklisted and that unauthorized USB HID/touchscreen devices are blocked or not bound to the driver. In test environments, malformed NEXIO packets should no longer cause out-of-bounds reads, abnormal ABS_X/ABS_Y coordinate generation from oversized lengths, or kernel faults.

Typical attack path

1. Gain physical access to a Linux system, compromise a USB peripheral path, or control a USB-emulated device presented to the system.
2. Present a device that binds to the Linux usbtouchscreen driver as a NEXIO-compatible touchscreen.
3. Send crafted interrupt packets containing oversized data_len and x_len fields.
4. Trigger the vulnerable nexio_read_data parsing loop to read beyond the coherent DMA transfer buffer.
5. Observe generated ABS_X and ABS_Y input events in userspace to infer data-dependent values from adjacent kernel memory.
6. Repeat crafted packet delivery to leak additional information or intentionally cause a kernel fault for denial of service.

How to detect it

Retrospective detection should focus on evidence of suspicious USB device attachment and kernel instability rather than a reliable network indicator, because exploitation occurs through USB device input handling. Review kernel logs, system journals, endpoint telemetry, and USB inventory records for unexpected touchscreen or usbtouchscreen device enumeration, especially on systems where no touchscreen should be present. Look for kernel oops, page faults, panics, or stack traces referencing usbtouchscreen or nexio_read_data. Correlate these events with physical access records, USB connect/disconnect events, udev logs, hypervisor USB passthrough changes, docking station use, and new input devices appearing under /dev/input. If available, review input telemetry for abnormal ABS_X or ABS_Y events from newly attached touchscreen devices, particularly values occurring immediately before a crash. There are no known public threat actors or ransomware campaigns associated with this issue based on the provided data.

• usbtouchscreen
• nexio_read_data
• NEXIO
• ABS_X
• ABS_Y
• /dev/input/event
• BUG: unable to handle page fault
• Oops:
• kernel panic
• usbcore: registered new interface driver usbtouchscreen
• input: USB Touchscreen
• input: Nexio
• usbtouchscreen:

What your security team should do

• Patch Linux kernels on systems that may attach USB touchscreens, kiosks, POS terminals, industrial consoles, shared workstations, and systems using USB passthrough.
• Inventory systems with the usbtouchscreen module loaded or available and identify whether NEXIO-compatible touchscreen hardware is used.
• Disable or blacklist usbtouchscreen where it is unnecessary, especially on servers and workstations that should not accept touchscreen input.
• Apply USB device control or allowlisting for environments exposed to public access, contractors, shared peripherals, docking stations, or removable hardware.
• Review logs for suspicious USB touchscreen enumeration, kernel oops events, and abnormal input-device activity around the time unknown USB devices were connected.
• Treat unexpected kernel crashes involving usbtouchscreen or nexio_read_data as potentially security-relevant and preserve logs for forensic review.