The Linux kernel synaptics-rmi4 input driver had a vulnerability where the gpio_key_map array was allocated with a maximum of 6 entries, but the code iterated over the full gpio_count (which can be up to 127). This mismatch allowed out-of-bounds reads and writes on gpio_key_map during input events and ioctl calls (EVIOCGKEYCODE and EVIOCSKEYCODE). Specifically, EVIOCGKEYCODE could leak adjacent slab memory to user space, and EVIOCSKEYCODE could write caller-controlled data beyond the allocated buffer. The vulnerability affects any process able to open the evdev node. The patch corrects the allocation size of gpio_key_map to match gpio_count, zero-filling extra entries and preventing out-of-bounds access.

This vulnerability allows local users with access to the evdev device node to perform out-of-bounds reads and writes in kernel memory. The out-of-bounds read can leak adjacent kernel slab memory to user space, potentially exposing sensitive information. The out-of-bounds write allows a user to write arbitrary values beyond the allocated buffer, which could lead to undefined behavior or kernel memory corruption. However, there is no indication of remote exploitation or widespread active exploitation in the wild.

A fix is available that properly sizes the gpio_key_map allocation to the full gpio_count, preventing out-of-bounds access. Users and administrators should update to the patched Linux kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or distribution advisory for the exact fixed kernel versions and apply updates accordingly.