The Linux kernel synaptics-rmi4 driver had a vulnerability (CVE-2026-64276) where the gpioled_key_map array was allocated with a size limited to min(gpioled_count, 6), but subsequent code iterated over the full gpioled_count (up to 31), causing out-of-bounds memory accesses. This affected the rmi_f30_attention interrupt handler and EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which used keycodemax set to gpioled_count but referenced the smaller allocated array. The fix involved allocating gpioled_key_map with the full gpioled_count size, preventing out-of-bounds access.

Devices reporting gpioled_count values greater than 6 with GPIO support enabled could trigger out-of-bounds reads and writes in kernel memory during interrupt handling and ioctl operations. This could potentially lead to kernel memory corruption or crashes. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by properly sizing the gpioled_key_map allocation. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available.