HIGH Introduced in 4.9
rmi4 F54 ReportSize Overflow
CVE-2026-80570
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow. Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.
02KernelScan AI Analysis
Risk summary
A local user with access to the RMI4 F54 diagnostics V4L2 device can trigger a heap buffer overflow by manipulating the V4L2 format size and inducing a report generation error. This can lead to arbitrary kernel memory corruption, potentially allowing privilege escalation or a system crash.
Vulnerability analysis
In the RMI4 F54 diagnostics driver, when a report generation or verification step fails, the cleanup that zeroes the stored report size is skipped. This leaves a stale, larger payload size from a previous successful run. If a user then shrinks the V4L2 buffer format and a later run fails, the buffer queue handler copies data using the stale larger size into the now-smaller buffer, causing a heap buffer overflow. The fix ensures the stored report size is always zeroed when any failure occurs. This vulnerability is reachable locally by an unprivileged user interacting with the V4L2 device node for the RMI4 touchpad diagnostics interface, requiring the specific hardware and driver to be present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.9 | 5.10.266 | 62079c17ec07 |
| 6.6 | 4.9 | 6.6.153 | 77749685e55d |
| 5.15 | 4.9 | 5.15.217 | 79521ed3cc9e |
| 6.18 | 4.9 | 6.18.46 | b28593a05afd |
| mainline | 4.9 | 7.2 | dc76c3c8e8ad |
| 7.1 | 4.9 | 7.1.10 | 88c8174d7290 |
| 6.1 | 4.9 | 6.1.184 | c669c64ab71a |
| 6.12 | 4.9 | 6.12.105 | c6cfda79f26c |
| cip/5.10 | 4.9 | 5.10.268-cip77 | 62079c17ec07 |
| cip/5.10-rt | 4.9 | 5.10.268-cip77-rt34 | 62079c17ec07 |
| cip/6.1 | 4.9 | 6.1.187-cip60 | c669c64ab71a |
| cip/6.12 | 4.9 | 6.12.108-cip31 | c6cfda79f26c |