CVE-2026-64275

In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device firmware or device tree provides invalid zero values for x_traces or y_traces, it results in a fatal division-by-zero exception leading to a kernel panic during device probe. Add checks to ensure these parameters are non-zero before performing the division. If invalid trace values are detected, fall back to a safe default of 1. Additionally, prevent an arithmetic underflow in the touch reporting logic. Previously, if the calculated or fallback width was smaller than ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a massive unsigned integer being reported to userspace. Clamp the adjusted width to a minimum of 0 to safely handle small physical dimensions and fallback scenarios. Completing the probe with safe fallback values ensures the sysfs nodes are created, keeping the firmware update path intact so a recovery firmware can be flashed to the device.

• CWE-369

• https://git.kernel.org/stable/c/01e0317c256c560d8dcce2e9825eb6142ee34611Patch
• https://git.kernel.org/stable/c/2f281ff0163a38fdc4cb4061f0c241e643283a5ePatch
• https://git.kernel.org/stable/c/59d4cc5e7a9785e4bdc9c55273274c6b49d4b58dPatch
• https://git.kernel.org/stable/c/6bac57d8fe2a077b8a85b4140eeb7999078158ebPatch
• https://git.kernel.org/stable/c/8c1db3418a419e788691746b9c47f863c2fd4890Patch
• https://git.kernel.org/stable/c/df2b818fa009c10ff6ba875a1663ff001cda9558Patch
• https://git.kernel.org/stable/c/f6d10af2036d1d4a847a74fe47ebbf93bce3c84cPatch
• https://git.kernel.org/stable/c/feb4866a42ec94764c7eb58012256f6f37664727Patch

Published

Jul 25, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6427The a3 Lazy Load plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-64270In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64271In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64272In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64273In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64274In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64276In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64277In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64278In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64279In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-6428SQL Injection in reports/catalogue_out.pl in Koha Community …7.6
• CVE-2026-64280In the Linux kernel, the following vulnerability has been re…8.8