Executive brief
A vulnerability in the Linux kernel's Synaptics RMI4 input driver could allow a local attacker to cause system instability or potentially access restricted memory. The issue occurs when the driver handles certain touchpad or input device configurations, leading to an out-of-bounds memory access. This could result in a system crash or unauthorized data access on affected Linux systems.
Technical details
An out-of-bounds (OOB) read/write vulnerability exists in the Synaptics RMI4 driver (drivers/input/rmi4/rmi_f30.c) within the Linux kernel. The function rmi_f30_map_gpios() incorrectly allocates the gpioled_key_map with a maximum of 6 entries, while rmi_f30_attention() and related ioctls (EVIOCGKEYCODE/EVIOCSKEYCODE) iterate based on the full gpioled_count (up to 31). A device reporting a count greater than 6 triggers OOB access. This can be exploited via local ioctl calls or by a malicious device to read or write kernel memory. The issue has been resolved by sizing the keymap to the full reported gpioled_count.
Affected products
- Linux Linux Kernel 3e64fcbdbd10 to 8c6d18d61bb6fe0e6edf848413391c590552e8a9
Timeline
- 2026-07-25: advisory: CVE-2026-64276 published by NVD
- 2026-07-24: patched: Fix committed to Linux stable tree
References
- https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8
- https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00
- https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9
- https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50
- https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded
- https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c
- https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119