PT-2026-64497 · Linux · Linux

CVE-2026-64276 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi f30 map gpios() allocates gpioled key map with min(gpioled count, TRACKSTICK RANGE END) == at most 6 entries, but rmi f30 attention() iterates the full f30->gpioled count (device query register, range 0..31) and dereferences gpioled key map[i], and input->keycodemax is set to the full gpioled count while input->keycode points at the 6-entry allocation.

A device that reports gpioled count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled count; the mapping loop still assigns only the first min(gpioled count, TRACKSTICK RANGE END) entries.

Related Identifiers

CVE-2026-64276

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64276 · Security Note
• https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00 · Note
• https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded · Note
• https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50 · Note
• https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954 · Note
• https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119 · Note
• https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9 · Note
• https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c · Note
• https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8 · Note