CVE-2026-80569

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the synaptics-rmi4 driver where the rmi f54 work() function reads a diagnostics report into the f54->report data buffer. The transfer size is determined by rmi f54 get report size(), which uses electrode counts from the F55 function. Because the F54 buffer is allocated based on F54 electrode counts and there is no constraint ensuring F55 counts do not exceed F54 counts, a malicious or malfunctioning RMI4 device reporting larger F55 electrode counts can cause the read loop to write past the allocated buffer. This leads to a buffer overflow during the write process and a subsequent out-of-bounds read during the V4L2 dequeue memcpy() operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.