In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to…
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:13 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
The vulnerability has been resolved in the Linux kernel by properly sizing the gpioled_key_map allocation. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available.
Description
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Impact
Devices reporting gpioled_count values greater than 6 with GPIO support enabled could trigger out-of-bounds reads and writes in kernel memory during interrupt handling and ioctl operations. This could potentially lead to kernel memory corruption or crashes. However, no known exploits in the wild have been reported.
Summary
The Linux kernel synaptics-rmi4 driver had a vulnerability (CVE-2026-64276) where the gpioled_key_map array was allocated with a size limited to min(gpioled_count, 6), but subsequent code iterated over the full gpioled_count (up to 31), causing out-of-bounds memory accesses. This affected the rmi_f30_attention interrupt handler and EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which used keycodemax set to gpioled_count but referenced the smaller allocated array. The fix involved allocating gpioled_key_map with the full gpioled_count size, preventing out-of-bounds access.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64276 (opens in a new tab)
- git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8 (opens in a new tab)
- git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00 (opens in a new tab)
- git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9 (opens in a new tab)
- git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50 (opens in a new tab)
- git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded (opens in a new tab)
- git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c (opens in a new tab)
- git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119 (opens in a new tab)
- git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954 (opens in a new tab)