{"id":"CVE-2026-64277","state":"PUBLISHED","title":"Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input->keycodemax is set to the full gpio_count\nwhile input->keycode points at the 6-entry allocation.\n\nA device that reports gpio_count > 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting.","publishedAt":"2026-07-25T08:49:21.936Z","updatedAt":"2026-10-19T20:28:17.252Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"502ad7caaa1a445b734c827fa256e5311df67e3d","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"3480e24bc4e178aaa009edb25b6ee12df199e210","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"35ed74d32d8260bdfb14a94caf402bf0866bdeec","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"ba57f430328534501962d60d651e385ffd7af9ca","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"850117b637bcb1dcc14be0cf09ac819a8707b42c","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"8db211aed83733073b0814adaeeab61d4521474e","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"57c10915f2c16c90e0d46ad00876bf39ece40fc2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/input/rmi4/rmi_f3a.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/input/rmi4/rmi_f3a.c"]}],"references":["https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d","https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210","https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec","https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca","https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c","https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e","https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64277.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64277","state":"PUBLISHED","datePublished":"2026-07-25T08:49:21.936Z","dateUpdated":"2026-10-19T20:28:17.252Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.776Z"},"containers":{"cna":{"title":"Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input->keycodemax is set to the full gpio_count\nwhile input->keycode points at the 6-entry allocation.\n\nA device that reports gpio_count > 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"502ad7caaa1a445b734c827fa256e5311df67e3d","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"3480e24bc4e178aaa009edb25b6ee12df199e210","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"35ed74d32d8260bdfb14a94caf402bf0866bdeec","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"ba57f430328534501962d60d651e385ffd7af9ca","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"850117b637bcb1dcc14be0cf09ac819a8707b42c","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"8db211aed83733073b0814adaeeab61d4521474e","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","versionType":"git"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","status":"affected","lessThan":"57c10915f2c16c90e0d46ad00876bf39ece40fc2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/input/rmi4/rmi_f3a.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/input/rmi4/rmi_f3a.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"},{"url":"https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"},{"url":"https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"},{"url":"https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"},{"url":"https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"},{"url":"https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"},{"url":"https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"},{"url":"https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The highest-severity defensible path is local: a process that can open the affected RMI touchpad's evdev node can invoke the vulnerable keymap ioctls. A malicious USB RMI device is also a physical trigger, but the local ioctl path is more severe.\nAC:L - On a vulnerable device reporting more than six GPIOs, selecting any keymap index from 6 through gpio_count-1 deterministically accesses beyond the allocation. No race or condition outside the attacker's control is required.\nPR:L - The evdev keymap ioctl path has no capability or authentication check; only ordinary device-node access controls apply. An unprivileged user with seat, ACL, or input-device access can exploit it without administrative capabilities.\nUI:N - The attacker directly issues EVIOCGKEYCODE or EVIOCSKEYCODE after opening the node. No action by another user is required.\nS:U - Exploitation compromises the host kernel within the same security authority. It does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - EVIOCGKEYCODE can disclose successive 16-bit words across as much as 242 bytes beyond the six-entry keymap, exposing adjacent slab contents and potentially kernel pointers. The accompanying corruption can also support stronger disclosure primitives.\nI:H - EVIOCSKEYCODE provides indexed, caller-controlled 16-bit writes throughout the out-of-bounds range. This heap corruption can overwrite adjacent pointers or control data and plausibly enable kernel code execution.\nA:H - The controlled heap overwrite can corrupt adjacent slab objects and cause a kernel oops or panic, while device attention interrupts repeatedly exercise the out-of-bounds read. The failure can be triggered repeatedly without victim interaction."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:52:32.147Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.12.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64277","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:38:13.158819Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:28:17.252Z"}}]}}}