Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

...

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

...

SUSE CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

UBUNTU-CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

EUVD-2026-48989

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

CVE-2026-64277

The CVE-2026-64277 issue affects the Linux kernel synaptics-rmi4 input driver. The rmi_f3a_map_gpios() path allocates gpio_key_map using min(gpio_count, TRACKSTICK_RANGE_END) (at most 6 entries), but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], while input-&g...

PT-2026-64498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synaptics-rmi4 driver where the rmi f3a initialize function retrieves a GPIO count from the device query register. While rmi f3a map gpios allocates the gpio key m...

Linux Distros Unpatched Vulnerability : CVE-2026-64277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf &...

PT-2025-30795

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the regulator/gpio subsystem where insufficient memory is allocated for the drvdata::gpiods array, leading to an out-of-bounds access when the number ...