CVE-2026-64276

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel Synaptics RMI4 Driver

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-15

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64276

EUVD

EUVD-2026-48988

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	4.14
linux	linux_kernel	4.14
linux	linux_kernel	4.14
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 4.14.1 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a mismatch in array sizes for the Synaptics RMI4 F30 keymap. The function rmi_f30_map_gpios() allocates a small array (max 6 entries) but rmi_f30_attention() uses a larger device-reported count (up to 31). This causes out-of-bounds memory access when handling attention interrupts or ioctl calls.

Detection Guidance

This vulnerability is specific to the Linux kernel's synaptics-rmi4 driver and requires kernel-level inspection. Detection involves checking kernel logs for errors related to rmi_f30_attention or out-of-bounds access in the synaptics-rmi4 module. Use commands like dmesg | grep rmi or journalctl -k | grep rmi to search for related errors.

Impact Analysis

An attacker could exploit this to read or write memory outside the intended array bounds. This might lead to system crashes, privilege escalation, or information disclosure. Systems using affected Synaptics touchpads with GPIO support enabled are vulnerable.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the vulnerability in the synaptics-rmi4 driver.

Hi! I’m here to help you understand CVE-2026-64276. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70