CVE-2026-80568

Received Received - Intake

Synaptics RMI4 Input Size Change Heap Overflow

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers. Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80568

EUVD

EUVD-2026-66483

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a heap buffer overflow risk when changing input types during streaming in the synaptics-rmi4 driver. If the diagnostic report type is changed mid-stream, the report size changes, potentially exceeding pre-allocated buffer sizes due to V4L2 buffer allocation based on initial size.

Detection Guidance

This vulnerability is specific to the Linux kernel's synaptics-rmi4 driver and V4L2 subsystem. Detection requires checking if the system is running a vulnerable kernel version and if the synaptics-rmi4 driver is active. Inspect kernel logs for errors related to VIDIOC_S_INPUT or heap buffer overflows during video input changes.

Impact Analysis

This could lead to system crashes, data corruption, or unauthorized memory access if exploited. It primarily affects systems using the synaptics-rmi4 driver with V4L2 video streaming functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue involving heap buffer overflow in V4L2 video input handling. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If patches are unavailable, disable the synaptics-rmi4 driver or avoid changing video input types while streaming. Monitor kernel logs for related errors as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-80568. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70