Skip to content
Fencer Vulns
high 7.8

CVE-2026-80569 json

Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

published 2026-08-26 2 mo ago modified 2026-08-27 2 mo ago also EUVD-2026-66484

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get_report_size():

report_size = rmi_f54_get_report_size(f54); ... for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) { int size = min(F54_REPORT_DATA_SIZE, report_size - i); ... rmi_read_block(.., f54->report_data + i, size); }

report_data is allocated once at probe from F54's own electrode counts (array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16))), but rmi_f54_get_report_size() computes the size from drv_data->num_*_electrodes when those are set, i.e. from the F55 function's electrode counts. Both counts come straight from device queries (F54 and F55 each report up to 255 electrodes) and nothing constrains the F55 counts to the F54 ones.

A malicious or malfunctioning RMI4 device that reports larger F55 electrode counts than its F54 counts makes report_size exceed the allocation, so the read loop writes past report_data (and the V4L2 dequeue memcpy() then reads past it). On conforming hardware the F55 configured electrodes are a subset of the F54 physical electrodes, so report_size never exceeds the buffer and well-behaved devices are unaffected.

Record the allocation size and reject a report that does not fit, mirroring the existing zero-size check.

Patch / fix

  • Linux Linux 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, 7.2
  • linux Debian 12 6.1.187-1
  • linux Debian 13 6.12.105-1
  • linux Debian 14 7.1.10-1
  • linux-6.12 Debian 12 6.12.107-1~deb12u1

debian advisories DEBIAN-CVE-2026-80569

  • linux Ubuntu 22.04 LTS 5.15.0-202.212
  • linux Ubuntu 26.04 LTS 7.0.0-42.42
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1119.126
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1120.130
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1115.121
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1113.117

ubuntu advisories UBUNTU-CVE-2026-80569

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-source Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-default Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-default-base Linux Micro 6.0 6.4.0-159998.55.1.159998.21.42
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.90.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.90.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1

suse advisories SUSE-SU-2026:24550-1SUSE-SU-2026:5091-1

  • kernel Azure Linux 3.0 6.6.157.1-1

azure linux advisories AZL-97803

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-80569 updated cvss 5.5

kernel: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.