Executive brief
The Linux kernel's synaptics-rmi4 touchpad driver contains a heap buffer overflow vulnerability in its F54 diagnostics module. If a user or application changes the diagnostic report type while video streaming is active, the report size changes but the pre-allocated buffers remain fixed, allowing an attacker to overflow heap memory. This could lead to system crashes, data corruption, or potential code execution on systems using affected Synaptics touchpad hardware.
Technical details
The vulnerability is a heap buffer overflow in the synaptics-rmi4 input driver's F54 diagnostics component (drivers/input/rmi4/rmi_f54.c). When a V4L2 video stream is active, buffers are allocated based on the diagnostic report size at stream start. If an attacker calls VIDIOC_S_INPUT to change the diagnostic report type mid-stream, the report size changes but the V4L2 buffers are not reallocated, causing overflow if the new size exceeds the original allocation. The fix blocks VIDIOC_S_INPUT with -EBUSY when the V4L2 queue is actively streaming by checking vb2_is_busy() before allowing input changes. The vulnerability requires local access to the V4L2 device interface but no privilege escalation; it affects systems with Synaptics RMI4 touchpad controllers using F54 diagnostics. A patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel affected versions prior to fix commit fbfd76746adc16d64be29ff113f673b70bc3f5c2
Timeline
- 2026-08-26: disclosed: CVE-2026-80568 published on NVD
- 2026-08-23: patched: Fix committed by Greg Kroah-Hartman to stable kernel tree