Executive brief
A vulnerability in the Linux kernel's Synaptics input driver could allow a local user to crash the system or access sensitive information. The issue occurs when the driver incorrectly handles certain hardware signals from touchpads or similar input devices. An attacker with local access to the device could exploit this to read or write restricted memory, potentially leading to a full system compromise.
Technical details
An out-of-bounds (OOB) read and write vulnerability exists in the Synaptics RMI4 driver (drivers/input/rmi4/rmi_f3a.c) due to a mismatch between the allocated size of the 'gpio_key_map' and the 'gpio_count' reported by the device. While the driver allocates a buffer for a maximum of 6 entries, it uses the full 'gpio_count' (up to 127) for bounds checking in ioctl calls like EVIOCGKEYCODE and EVIOCSKEYCODE. A local attacker with permissions to open the evdev node can trigger OOB reads to leak adjacent slab memory or OOB writes to corrupt kernel memory. The fix involves sizing the keymap buffer to match the full reported GPIO count.
Affected products
- Linux Linux Kernel 9e4c596bfd00 to 57c10915f2c1
Timeline
- 2026-06-14: other: Vulnerability reported by researcher
- 2026-07-24: patched: Patches committed to stable kernel branches
- 2026-07-25: advisory: CVE-2026-64277 published
References
- https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210
- https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec
- https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d
- https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2
- https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42
- https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c
- https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e