PT-2026-64498 · Linux · Linux
CVE-2026-64277
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
rmi f3a initialize() takes the GPIO count from the device query register
(f3a->gpio count = buf & RMI F3A GPIO COUNT, range 0..127).
rmi f3a map gpios() then allocates gpio key map with
min(gpio count, TRACKSTICK RANGE END) == at most 6 entries, but
rmi f3a attention() iterates the full gpio count and dereferences
gpio key map[i], and input->keycodemax is set to the full gpio count
while input->keycode points at the 6-entry allocation.
A device that reports gpio count > 6 therefore causes an out-of-bounds
read of gpio key map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input default getkeycode() and
input default setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio count. The mapping loop is unchanged:
it still assigns only the first min(gpio count, TRACKSTICK RANGE END)
entries; the remaining slots stay KEY RESERVED (devm kcalloc zero-fills)
and are skipped when reporting.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux