{"id":"CVE-2026-64276","summary":"Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.","modified":"2026-07-27T04:03:21.110041017Z","published":"2026-07-25T08:49:21.300Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64276.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64276.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64276"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3e64fcbdbd10e46dede502d507dbcc104837cd59"},{"fixed":"8c6d18d61bb6fe0e6edf848413391c590552e8a9"},{"fixed":"d162a1ead7de404d8b41a093c83ed0db6487cded"},{"fixed":"f0be9eba946e9200b43265e0a748d38bd0a56954"},{"fixed":"26c895928d7118436a24f564587cb4aefc40cdd8"},{"fixed":"4e3689c26854356f41fbaa1eafa382e58ac79e00"},{"fixed":"e849c6f51e6877104c765da084e001ec37c8e119"},{"fixed":"bfe622efecd4ff0a792d0ecd1a8dce535a902f50"},{"fixed":"d577e46785d45484b2ab7e7309c49b18764bf56c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64276.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64276.json"}}],"schema_version":"1.7.5"}