kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

EUVD-2026-48989

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277

The CVE-2026-64277 issue affects the Linux kernel synaptics-rmi4 input driver. The rmi_f3a_map_gpios() path allocates gpio_key_map using min(gpio_count, TRACKSTICK_RANGE_END) (at most 6 entries), but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], while input-&g...

PT-2026-64498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synaptics-rmi4 driver where the rmi f3a initialize function retrieves a GPIO count from the device query register. While rmi f3a map gpios allocates the gpio key m...