Executive brief
The Linux kernel's Synaptics RMI4 touchpad driver contains a buffer overflow vulnerability in the F54 diagnostic report handler. A malicious or faulty touchpad device can trigger a memory write past the allocated buffer by reporting mismatched electrode counts. This could lead to kernel memory corruption, system crash, or potential code execution with kernel privileges.
Technical details
The vulnerability is a heap buffer overflow in the synaptics-rmi4 input driver's F54 function (drivers/input/rmi4/rmi_f54.c). The root cause is a mismatch between two independently sized buffers: the F54 physical electrode count (used to allocate report_data) and the F55 configured electrode count (used to compute report_size). A device can report larger F55 electrode counts than F54 counts, causing rmi_f54_work() to read more data than the allocated buffer can hold. The rmi_read_block() call writes past report_data, and the subsequent V4L2 dequeue memcpy() reads out-of-bounds memory. Attack requires a malicious or malfunctioning RMI4 device on the system (local/adjacent). The fix validates that computed report_size does not exceed the allocation size and rejects oversized reports, mirroring an existing zero-size check.
Affected products
- Linux Linux kernel affected versions prior to patches dated 2026-08-23
Timeline
- 2026-08-26: disclosed: Published as CVE-2026-80569
- 2026-08-23: patched: Patch merged into stable kernel trees; commits 12be3c6ca9589afd6ade41a59c761866e526634d and 42eaf0e6f79c487f419737314cf0760f7331d368