CVE-2026-64277

Analyzed Analyzed - Analysis Complete

Linux Kernel Out-of-Bounds Read in Synaptics RMI4

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64277

EUVD

EUVD-2026-48989

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.10 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bounds issue in the synaptics-rmi4 driver. The function rmi_f3a_initialize reads a GPIO count from a device register, which can be up to 127. However, rmi_f3a_map_gpios allocates a keymap buffer limited to 6 entries. The function rmi_f3a_attention then incorrectly iterates over the full GPIO count, leading to out-of-bounds reads and writes when accessing the keymap. This allows memory corruption and potential data leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's synaptics-rmi4 driver and requires kernel-level inspection. Detection involves checking kernel logs for out-of-bounds access errors or examining the synaptics-rmi4 driver code for devices with gpio_count > 6. Commands like dmesg | grep -i rmi or journalctl -k | grep -i rmi may show related errors. However, no direct network detection commands are applicable.

Impact Analysis

This vulnerability can impact users by allowing local attackers to read sensitive memory or write arbitrary data through the evdev interface. Attackers could exploit this to leak kernel memory to userspace or corrupt kernel memory, potentially leading to privilege escalation or denial-of-service attacks on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a Linux kernel memory safety issue involving out-of-bounds reads and writes in input device handling. Compliance implications would depend on how the affected system is used, not the vulnerability itself.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for the synaptics-rmi4 driver. If immediate patching is not possible, disable the affected driver module (synaptics-rmi4) temporarily until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70