{"id":"CVE-2026-64277","revision":"3fcdd81d0d8c4bb594e2f866dd379d22","records":[{"revision":"3fcdd81d0d8c4bb594e2f866dd379d22","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64277","aliases":[],"title":"Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input->keycodemax is set to the full gpio_count\nwhile input->keycode points at the 6-entry allocation.\n\nA device that reports gpio_count > 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting.","state":0,"publishedAt":"2026-07-25T08:49:21.936+00:00","modifiedAt":"2026-10-19T20:28:17.252+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/input/rmi4/rmi_f3a.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"502ad7caaa1a445b734c827fa256e5311df67e3d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"3480e24bc4e178aaa009edb25b6ee12df199e210\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"35ed74d32d8260bdfb14a94caf402bf0866bdeec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"ba57f430328534501962d60d651e385ffd7af9ca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"850117b637bcb1dcc14be0cf09ac819a8707b42c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"8db211aed83733073b0814adaeeab61d4521474e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9e4c596bfd004f447a652205163234dfd4aafa69\",\n                            \"lessThan\": \"57c10915f2c16c90e0d46ad00876bf39ece40fc2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/input/rmi4/rmi_f3a.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.96\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d","https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210","https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec","https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca","https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c","https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e","https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64277","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64277","identifiers":["CVE-2026-64277"]},"retained":false,"historicalAffected":[]}],"coverage":[]}