Executive brief
The Linux kernel's HID-RMI driver for Synaptics touchpad devices fails to validate report sizes from the device hardware, allowing out-of-bounds memory reads and writes. An attacker with a malicious RMI touchpad device can trigger memory corruption, leak sensitive kernel data to userspace, or cause system hangs during device probe, potentially compromising system stability and confidentiality.
Technical details
The hid-rmi driver allocates read and write buffers based solely on the report descriptor size supplied by the device, with no minimum size enforcement. The vulnerability manifests in three ways: (1) write operations access fixed offsets (writeReport[0..5] and writeReport[4]) even when the allocated buffer is only 2–4 bytes, causing heap overflow and corruption of adjacent kernel objects; (2) read operations copy data based on a device-controlled length field (readReport[1], up to 255 bytes) with no bounds check against input_report_size, reading past the allocation; (3) the read loop cannot terminate on zero-length replies, causing an infinite wait loop inside the probe worker. A device declaring minimally-sized reports (1 byte input, 1 byte output) triggers OOB access unconditionally at probe time through rmi_f01_probe(), which issues a fixed 21-byte register read. Leaked heap contents are exposed to unprivileged userspace via sysfs attributes and sent back to the device via interrupt masks. The fix validates minimum report sizes (6 output, 3 input bytes), clamps read/write operations to declared sizes, rejects zero-length replies, and clears the RMI_DEVICE flag to prevent further RMI setup on undersized devices.
Affected products
- Linux Linux kernel affected versions prior to patch
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix committed to Linux kernel addressing report size validation and bounds checking