PT-2026-61225 · Linux · Linux
CVE-2026-63908
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Input: atmel mxt ts - fix boundary check in mxt prepare cfg mem
When a configuration file provides an object size that is larger than the
driver's known mxt obj size(object), the driver intends to discard the
extra bytes.
The loop iterates using for (i = 0; i < size; i++). Inside the loop, the
condition to skip processing extra bytes is:
if (i > mxt obj size(object))
continue;
Since i is a 0-based index, the valid indices for the object are 0 through
mxt obj size(object) - 1.
When i == mxt obj size(object), the condition evaluates to false, and the
code processes the byte instead of discarding it.
This causes the code to calculate byte offset = reg + i - cfg->start ofs
and writes the byte there, overwriting exactly one byte of the adjacent
instance or object.
Update the boundary check to skip extra bytes correctly by using >=.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux