HIGH Introduced in 4.10
rmi4 F55 Electrode OOB
CVE-2026-80754
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos. This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses. Fix the typos by correctly assigning the TX electrode counts.
02KernelScan AI Analysis
Risk summary
A copy-paste typo in the Synaptics RMI4 F55 sensor detection code caused the transmitter electrode count to be incorrectly set to the receiver count. On devices with more RX than TX electrodes, this inflated the TX count used by F54 diagnostics, leading to incorrect report size calculations and potential out-of-bounds buffer accesses. Any local user on a system with an affected RMI4 touch device could trigger this through diagnostics operations.
Vulnerability analysis
During initialization of the touch sensor, a copy-paste error caused the transmitter electrode count to be set to the receiver electrode count instead of its own correct value. This wrong count was then used by the diagnostics reporting function to calculate buffer sizes. On hardware where the receiver count exceeds the transmitter count, the diagnostics function would calculate a buffer size larger than the actual data available, leading to out-of-bounds memory access when reading diagnostic reports. The fix corrects these assignments so the proper transmitter count is used throughout. The vulnerable code runs on systems with Synaptics RMI4 touch devices; a local user can trigger diagnostics reads through the input subsystem without needing elevated privileges beyond access to the device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 4.10 | 6.6.153 | 0739c65e799d |
| mainline | 4.10 | 7.2 | 6058f0fea10f |
| 6.12 | 4.10 | 6.12.105 | 9759502f5cd7 |
| 6.18 | 4.10 | 6.18.46 | 9b184c8337c6 |
| 6.1 | 4.10 | 6.1.184 | a6d9646e77da |
| 7.1 | 4.10 | 7.1.10 | a81cafe3c3c2 |
| 5.10 | 4.10 | 5.10.266 | 6484e00d6778 |
| 5.15 | 4.10 | 5.15.217 | db4e20265ebd |
| cip/4.19 | 4.10 | 4.19.325-cip136 | 81fd1764b827 |
| cip/4.19-rt | 4.10 | 4.19.325-cip136-rt50 | 81fd1764b827 |
| cip/5.10 | 4.10 | 5.10.268-cip77 | 6484e00d6778 |
| cip/5.10-rt | 4.10 | 5.10.268-cip77-rt34 | 6484e00d6778 |
| cip/6.1 | 4.10 | 6.1.187-cip60 | a6d9646e77da |
| cip/6.12 | 4.10 | 6.12.108-cip31 | 9759502f5cd7 |