{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem  When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the extra bytes.  The loop iterates using for (i = 0; i \u003c size; i++). Inside the loop, the condition to skip processing extra bytes is:      if (i \u003e mxt_obj_size(object))         continue;  Since i is a 0-based index, the valid indices for the object are 0 through mxt_obj_size(object) - 1.  When i == mxt_obj_size(object), the condition evaluates to false, and the code processes the byte instead of discarding it.  This causes the code to calculate byte_offset = reg + i - cfg-\u003estart_ofs and writes the byte there, overwriting exactly one byte of the adjacent instance or object.  Update the boundary check to skip extra bytes correctly by using \u003e=.",
  "id": "DEBIAN-CVE-2026-63908",
  "modified": "2026-09-14T16:47:48.288973098Z",
  "published": "2026-07-19T16:17:08.620Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-63908"
    }
  ],
  "upstream": [
    "CVE-2026-63908"
  ]
}