CVE-2026-64276

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi_f30_map_gpios() allocates gpioled_key_map with

min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but

rmi_f30_attention() iterates the full f30->gpioled_count (device query

register, range 0..31) and dereferences gpioled_key_map[i], and

input->keycodemax is set to the full gpioled_count while input->keycode

points at the 6-entry allocation.

A device that reports gpioled_count > 6 with GPIO support enabled

therefore causes an out-of-bounds read on the attention interrupt and

out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,

which bound the index only against keycodemax. This is the same defect

as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled_count; the mapping loop still

assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References