CVE-2026-64276

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the synaptics-rmi4 driver where the rmi f30 map gpios() function allocates the gpioled key map with a maximum of 6 entries. However, the rmi f30 attention() function iterates through the full f30->gpioled count (which can range from 0 to 31) and dereferences gpioled key map[i]. Additionally, input->keycodemax is set to the full gpioled count while input->keycode points to the smaller 6-entry allocation. If a device reports a gpioled count greater than 6 with GPIO support enabled, it leads to an out-of-bounds read during the attention interrupt and out-of-bounds read/write operations via the EVIOCGKEYCODE and EVIOCSKEYCODE ioctls. This same defect also affects the F3A handler.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.