Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-64277

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 502ad7caaa1a445b734c827fa256e5311df67e3d; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 3480e24bc4e178aaa009edb25b6ee12df199e210; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 35ed74d32d8260bdfb14a94caf402bf0866bdeec; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in ba57f430328534501962d60d651e385ffd7af9ca; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 850117b637bcb1dcc14be0cf09ac819a8707b42c; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 8db211aed83733073b0814adaeeab61d4521474e; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42; From 9e4c596bfd004f447a652205163234dfd4aafa69 · fixed in 57c10915f2c16c90e0d46ad00876bf39ece40fc2

  • Linux Linux

    5.10

  • KernelLinux

    From 5.10.0 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.96; From 6.13.0 · fixed in 6.18.39; From 6.19.0 · fixed in 7.1.4

References 8

git.kernel.org