HIGH Introduced in 4.9
rmi4 F54 Diagnostics Overflow
CVE-2026-80568
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers. Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).
02KernelScan AI Analysis
Risk summary
A local user with access to a Synaptics RMI4 touch device's V4L2 interface can trigger a heap buffer overflow by changing the diagnostic input type while streaming. This can lead to kernel memory corruption, potentially allowing privilege escalation or a system crash. The vulnerability requires specific hardware and access to the device node.
Vulnerability analysis
The Synaptics RMI4 F54 diagnostics driver exposes a V4L2 interface that allows changing the diagnostic report type while streaming is active. Because V4L2 buffers are allocated based on the report size at stream start, switching to a larger report type mid-stream causes the driver to write beyond the allocated buffer, resulting in a heap overflow. The fix blocks the input change operation with an error if the V4L2 queue is busy, preventing the size mismatch. This vulnerability can be triggered locally by a user with access to the V4L2 device node, typically on a system with a compatible RMI4 touch device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 4.9 | 6.1.184 | 493ba8e79472 |
| 6.6 | 4.9 | 6.6.153 | 1d718f146176 |
| 5.15 | 4.9 | 5.15.217 | fa69f93015be |
| mainline | 4.9 | 7.2 | fbfd76746adc |
| 6.18 | 4.9 | 6.18.46 | ff0849705d29 |
| 5.10 | 4.9 | 5.10.266 | 7e994a9ecc0b |
| 6.12 | 4.9 | 6.12.105 | cae79513f911 |
| 7.1 | 4.9 | 7.1.10 | ddd9a53faf3b |
| cip/4.19 | 4.9 | 4.19.325-cip136 | 92d34cf591e1 |
| cip/4.19-rt | 4.9 | 4.19.325-cip136-rt50 | 92d34cf591e1 |
| cip/5.10 | 4.9 | 5.10.268-cip77 | 7e994a9ecc0b |
| cip/5.10-rt | 4.9 | 5.10.268-cip77-rt34 | 7e994a9ecc0b |
| cip/6.1 | 4.9 | 6.1.187-cip60 | 493ba8e79472 |
| cip/6.12 | 4.9 | 6.12.108-cip31 | cae79513f911 |