{"id":"CVE-2026-64276","revision":"357966d4b2ff49c7be50afc276572c02","records":[{"revision":"357966d4b2ff49c7be50afc276572c02","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64276","aliases":[],"title":"Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30->gpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput->keycodemax is set to the full gpioled_count while input->keycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count > 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.","state":0,"publishedAt":"2026-07-25T08:49:21.3+00:00","modifiedAt":"2026-10-19T20:28:17.083+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/input/rmi4/rmi_f30.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"8c6d18d61bb6fe0e6edf848413391c590552e8a9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"d162a1ead7de404d8b41a093c83ed0db6487cded\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"f0be9eba946e9200b43265e0a748d38bd0a56954\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"26c895928d7118436a24f564587cb4aefc40cdd8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"4e3689c26854356f41fbaa1eafa382e58ac79e00\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"e849c6f51e6877104c765da084e001ec37c8e119\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"bfe622efecd4ff0a792d0ecd1a8dce535a902f50\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\n                            \"lessThan\": \"d577e46785d45484b2ab7e7309c49b18764bf56c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/input/rmi4/rmi_f30.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.96\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9","https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded","https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954","https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8","https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00","https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119","https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50","https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64276","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64276","identifiers":["CVE-2026-64276"]},"retained":false,"historicalAffected":[]}],"coverage":[]}