CVE-2026-64277

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the synaptics-rmi4 driver where the rmi f3a initialize() function retrieves a GPIO count from the device query register. While rmi f3a map gpios() allocates the gpio key map with a maximum of 6 entries, the rmi f3a attention() function iterates through the full GPIO count, leading to an out-of-bounds read of the gpio key map[] array during attention interrupts. Additionally, because input->keycodemax is set to the full GPIO count while input->keycode points to the smaller allocation, out-of-bounds accesses occur via the input core's default keymap ioctls. Specifically, the EVIOCGKEYCODE endpoint can leak adjacent slab memory to user space, and the EVIOCSKEYCODE endpoint allows a process with access to the evdev node to write caller-controlled values past the buffer. This occurs because input default getkeycode() and input default setkeycode() only validate the index against keycodemax.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.