In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073374 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

    nexio_read_data() pulls data_len and x_len from a packed __be16 header     in the device's interrupt packet and then walks packet->data[0..x_len)     and packet->data[x_len..data_len) comparing each byte against a     threshold.

    Both fields are 16-bit on the wire (max 65535).  The existing     adjustments shave at most 0x100 / 0x80 off, so the loop bound can still     reach roughly 0xfeff.  The URB transfer buffer for NEXIO is rept_size     (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the     packed header  so packet->data[] has 1017 valid bytes.  read_data()     callbacks are not given urb->actual_length, and nothing else bounds the     walk.

    A device that lies about its length can get a ~64 KiB out-of-bounds read     past the coherent DMA allocation.  The first index whose byte exceeds     NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the     reported touch coordinates, so adjacent kernel memory contents leak to     userspace as ABS_X / ABS_Y events.  Far enough out, the read can also     hit an unmapped page and fault.

    Fix this all by clamping data_len to the buffer's data[] capacity and     x_len to data_len.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and     x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len)     and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the     wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still     reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from     usb_alloc_coherent(), with the first 7 occupied by the packed header  so packet->data[] has 1017 valid     bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device     that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The     first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported     touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far     enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the     buffer's data[] capacity and x_len to data_len. (CVE-2026-64014)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347900	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343295	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073374)	Nessus	Unity Linux Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328101	Linux Distros Unpatched Vulnerability : CVE-2026-64014	Nessus	Misc.	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64014

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high