CVE-2026-64276

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

State: Published
Severity: 7.8 High
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation.

A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	3e64fcbdbd10e46dede502d507dbcc104837cd59 to before 8c6d18d61bb6fe0e6edf848413391c590552e8a9Affected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before d162a1ead7de404d8b41a093c83ed0db6487cdedAffected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before f0be9eba946e9200b43265e0a748d38bd0a56954Affected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before 26c895928d7118436a24f564587cb4aefc40cdd8Affected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before 4e3689c26854356f41fbaa1eafa382e58ac79e00Affected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before e849c6f51e6877104c765da084e001ec37c8e119Affected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before bfe622efecd4ff0a792d0ecd1a8dce535a902f50Affected 3e64fcbdbd10e46dede502d507dbcc104837cd59 to before d577e46785d45484b2ab7e7309c49b18764bf56cAffected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3e64fcbdbd10e46dede502d507dbcc104837cd59 to before 8c6d18d61bb6fe0e6edf848413391c590552e8a9Affected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before d162a1ead7de404d8b41a093c83ed0db6487cdedAffected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before f0be9eba946e9200b43265e0a748d38bd0a56954Affected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before 26c895928d7118436a24f564587cb4aefc40cdd8Affected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before 4e3689c26854356f41fbaa1eafa382e58ac79e00Affected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before e849c6f51e6877104c765da084e001ec37c8e119Affected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before bfe622efecd4ff0a792d0ecd1a8dce535a902f50Affected
3e64fcbdbd10e46dede502d507dbcc104837cd59 to before d577e46785d45484b2ab7e7309c49b18764bf56cAffected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.