Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80569
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-26 15:17:12 UTC
Updated2026-08-27 06:17:42 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get_report_size(): report_size = rmi_f54_get_report_size(f54); ... for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) { int size = min(F54_REPORT_DATA_SIZE, report_size - i); ... rmi_read_block(.., f54->report_data + i, size); } report_data is allocated once at probe from F54's own electrode counts (array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))), but rmi_f54_get_report_size() computes the size from drv_data->num_*_electrodes when those are set, i.e. from the F55 function's electrode counts. Both counts come straight from device queries (F54 and F55 each report up to 255 electrodes) and nothing constrains the F55 counts to the F54 ones. A malicious or malfunctioning RMI4 device that reports larger F55 electrode counts than its F54 counts makes report_size exceed the allocation, so the read loop writes past report_data (and the V4L2 dequeue memcpy() then reads past it). On conforming hardware the F55 configured electrodes are a subset of the F54 physical electrodes, so report_size never exceeds the buffer and well-behaved devices are unaffected. Record the allocation size and reject a report that does not fit, mirroring the existing zero-size check.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001200000 probability, percentile 0.020580000 (date 2026-08-27)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb 6b3bdd44d4cd7d5e35de1d0f06d4930f3cecd403 git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb b2f596f00d27703ce09167201ba57f55be8d2f9a git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb b3932101c9c457148038392bc977f9b31e125a86 git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb 12be3c6ca9589afd6ade41a59c761866e526634d git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb 42eaf0e6f79c487f419737314cf0760f7331d368 git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb 6b06aab79ff166d5781ce792d91acc2e58b1770b git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb b7b9a8b1c303b62371698e396654d6724c79cb74 git Not specified
CNA Linux Linux affected c762cc68b6a12eedebefc156ea4838e54804e2eb 49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1 git Not specified
CNA Linux Linux affected 4.10 Not specified
CNA Linux Linux unaffected 4.10 semver Not specified
CNA Linux Linux unaffected 5.10.266 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.217 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.184 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.153 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.105 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.46 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.10 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/6b06aab79ff166d5781ce792d91acc2e58b1770b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b2f596f00d27703ce09167201ba57f55be8d2f9a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/12be3c6ca9589afd6ade41a59c761866e526634d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6b3bdd44d4cd7d5e35de1d0f06d4930f3cecd403 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/42eaf0e6f79c487f419737314cf0760f7331d368 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b7b9a8b1c303b62371698e396654d6724c79cb74 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/49c5adc2b7d6e43c5cf033e1c86fdb9c16ababb1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b3932101c9c457148038392bc977f9b31e125a86 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report