CVE-2026-80570
Received Received - Intake

Heap Buffer Overflow in Linux Kernel Synaptics RMI4

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow. Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80570
EUVD
EUVD-2026-66485

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where an error in the synaptics-rmi4 driver could lead to a heap buffer overflow. If a report request fails, the code previously did not reset the report size to zero, causing it to retain a previous larger size. When a user changes the buffer size to a smaller one and another failure occurs, the stale larger size is copied into the smaller buffer, overflowing it.

Detection Guidance

This vulnerability is specific to the Linux kernel's synaptics-rmi4 driver and requires kernel-level inspection. Detection involves checking kernel logs for errors related to rmi_f54_work() or synaptics-rmi4. Use commands like dmesg | grep -i rmi or journalctl -k | grep -i rmi to search for relevant errors.

Impact Analysis

This vulnerability could allow an attacker to cause a heap buffer overflow, potentially leading to system crashes, data corruption, or arbitrary code execution. It may also enable privilege escalation if exploited successfully.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, disable the synaptics-rmi4 driver if not required. Monitor kernel logs for signs of exploitation attempts or errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart