CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64276 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

EUVD-2026-48988

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64276 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

CVE-2026-64277

The CVE-2026-64277 issue affects the Linux kernel synaptics-rmi4 input driver. The rmi_f3a_map_gpios() path allocates gpio_key_map using min(gpio_count, TRACKSTICK_RANGE_END) (at most 6 entries), but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], while input-&g...

CVE-2026-64276

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6 entries, but rmif30attention iterates the full f30-gpioledcount devic...

Linux Distros Unpatched Vulnerability : CVE-2026-64277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf &...

PT-2026-64498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synaptics-rmi4 driver where the rmi f3a initialize function retrieves a GPIO count from the device query register. While rmi f3a map gpios allocates the gpio key m...

Linux Distros Unpatched Vulnerability : CVE-2026-64276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmif30mapgpios allocates gpioledkeymap with mingpioledcount, TRACKSTICKRANGEEND == at most 6...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 – fixed the use of memory after it is freed in rmiunregisterfunction. The putdevice function calls rmireleasefunction, which frees the “fn” pointer. Therefore, dereferencing fn-numofirqs in the next line...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-430123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-430123 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls...

Linux Distros Unpatched Vulnerability : CVE-2023-52840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls...

kernel: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls rmireleasefunction which frees "fn" so the dereference on the next line "fn-numofirqs" is a use after free. Move the putdevice to the end to...

kernel: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls rmireleasefunction which frees "fn" so the dereference on the next line "fn-numofirqs" is a use after free. Move the putdevice to the end to...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction CVE-2023-52840 In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header CVE-2023-52843 I...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction CVE-2023-52840 In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header CVE-2023-52843 I...

CVE-2023-52840

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls rmireleasefunction which frees "fn" so the dereference on the next line "fn-numofirqs" is a use after free. Move the putdevice to the end to...

DEBIAN-CVE-2023-52840

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls rmireleasefunction which frees "fn" so the dereference on the next line "fn-numofirqs" is a use after free. Move the putdevice to the end to...

CVE-2023-52840

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction The putdevice calls rmireleasefunction which frees "fn" so the dereference on the next line "fn-numofirqs" is a use after free. Move the putdevice to the end to...