PT-2026-64497 · Linux · Linux
CVE-2026-64276
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi f30 map gpios() allocates gpioled key map with
min(gpioled count, TRACKSTICK RANGE END) == at most 6 entries, but
rmi f30 attention() iterates the full f30->gpioled count (device query
register, range 0..31) and dereferences gpioled key map[i], and
input->keycodemax is set to the full gpioled count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled count; the mapping loop still
assigns only the first min(gpioled count, TRACKSTICK RANGE END) entries.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux