CVE-2026-63908

Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

published July 19, 2026

CVSS
—
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

When a configuration file provides an object size that is larger than the

driver's known mxt_obj_size(object), the driver intends to discard the

extra bytes.

The loop iterates using for (i = 0; i < size; i++). Inside the loop, the

condition to skip processing extra bytes is:

if (i > mxt_obj_size(object))

continue;

Since i is a 0-based index, the valid indices for the object are 0 through

mxt_obj_size(object) - 1.

When i == mxt_obj_size(object), the condition evaluates to false, and the

code processes the byte instead of discarding it.

This causes the code to calculate byte_offset = reg + i - cfg->start_ofs

and writes the byte there, overwriting exactly one byte of the adjacent

instance or object.

Update the boundary check to skip extra bytes correctly by using >=.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.8th percentile
Published
2026-07-19T14:55Z
EPSS history
Timeline
  • 19 JUL 14:55Z
    Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    cvelistv5