What’s Vulnerable › Vulnerabilities

CVE-2026-64237: Input: elan_i2c - validate firmware size before use

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-10-24
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before accessing them to prevent potential out-of-bounds reads.

Affected products

• Linux kernel: from 4.0 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.35 — fixed in 5.10.259, 5.15.210, 6.1.176, 6.12.93, 6.18.35, 6.6.143

How to fix

Upgrade to a fixed version: Linux kernel 5.10.259, 5.15.210, 6.1.176, 6.12.93. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/331d49b4e1c9efe4479bbd22922dfcdd8c64be7b
• https://git.kernel.org/stable/c/3b37190ad3ded3a15fb1dbfc4f26df520a3e59bb
• https://git.kernel.org/stable/c/47b52b98edfe34d0249e72f815215ef24311c3a3
• https://git.kernel.org/stable/c/48b0aa9c08a3ac8e0c0345b7ca581f552324e460
• https://git.kernel.org/stable/c/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634
• https://git.kernel.org/stable/c/bf769358419e00344c1b16fa034d058f563d46a1
• https://git.kernel.org/stable/c/c2c3b33b3c0bf2c9427c0926817ef5ffac50de6f
• https://git.kernel.org/stable/c/d97baee9590edf303b3eca432e61de9320834fe1

Get alerted when CVE-2026-64237 or the next vulnerability affects your stack