Executive brief
The Linux kernel's Synaptics RMI4 touch input driver had a bug where worker thread failures (timeouts, register read errors) were silently ignored, allowing stale or uninitialized memory to be delivered to userspace applications. This could cause applications reading touch sensor diagnostic data to receive incorrect or uninitialized information, potentially causing application crashes or unpredictable behavior.
Technical details
The vulnerability is a missing error propagation in the rmi_f54_buffer_queue() function of the synaptics-rmi4 input driver (drivers/input/rmi4/rmi_f54.c). When a V4L2 buffer queue operation waited for an F54 worker thread to complete, it did not check the worker's exit status—if the worker encountered a timeout or hardware register read failure, the function would return success and deliver uninitialized or stale buffer data to userspace. The fix adds a 'report_error' field to struct f54_data to capture the worker's error status and checks this field in rmi_f54_buffer_queue() to mark the buffer as VB2_BUF_STATE_ERROR if an error occurred. This is a low-severity information disclosure via uninitialized memory.
Affected products
- Linux Linux kernel all versions containing the synaptics-rmi4 driver (affected by fix since 2026-06-25)
Timeline
- 2026-08-26: disclosed: Published to NVD
- 2026-06-25: patched: Fix commit 8786d74bf50e6797b6f655eb381ef6b25451161f by Dmitry Torokhov
- 2026-08-23: patched: Backported to stable kernels via commits 2b0403fb7e28f65883cd03814b62c9aa9bc7f04d and 305c24ee25b6e08ac9f4c5f697e823cc638c38da