Executive brief
The Linux kernel's Synaptics touchpad driver contains a copy-paste error where transmitter (TX) electrode count is incorrectly set to the receiver (RX) count during sensor detection. On devices with more RX than TX electrodes, this causes the driver to calculate an inflated diagnostics buffer size, leading to potential out-of-bounds memory access that could crash the system or enable local privilege escalation.
Technical details
This is a logic error in the synaptics-rmi4 driver (drivers/input/rmi4/rmi_f55.c) where two typos in the F55 sensor detection function cause TX electrode counts to be overwritten with RX values. The affected variables are `f55->cfg_num_tx_electrodes` and `drv_data->num_tx_electrodes`, which are later used by the F54 diagnostics function to determine report buffer size. On devices with asymmetric electrode configurations (more RX than TX), this inflates the perceived TX count and causes incorrect memory allocation, creating an out-of-bounds condition. The vulnerability requires local system access and affects the kernel input subsystem. A patch correcting the assignments was committed upstream and backported to stable kernels.
Affected products
- Linux Linux kernel Multiple kernel versions (see git.kernel.org stable branches); affects synaptics-rmi4 driver since introduction of F55/F54 support
Timeline
- 2026-09-03: disclosed: CVE-2026-80754 published
- 2026-08-23: patched: Backported to stable kernels by Greg Kroah-Hartman
- 2026-08-04: patched: Upstream fix committed by Dmitry Torokhov (commit 6058f0fea10f3caf63a435677358d1b8e9325114)