{"id":"CVE-2026-64277","summary":"Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a-\u003egpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input-\u003ekeycodemax is set to the full gpio_count\nwhile input-\u003ekeycode points at the 6-entry allocation.\n\nA device that reports gpio_count \u003e 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting.","modified":"2026-07-26T05:17:33.776913924Z","published":"2026-07-25T08:49:21.936Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64277.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"},{"type":"WEB","url":"https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"},{"type":"WEB","url":"https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"},{"type":"WEB","url":"https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64277.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64277"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9e4c596bfd004f447a652205163234dfd4aafa69"},{"fixed":"502ad7caaa1a445b734c827fa256e5311df67e3d"},{"fixed":"3480e24bc4e178aaa009edb25b6ee12df199e210"},{"fixed":"35ed74d32d8260bdfb14a94caf402bf0866bdeec"},{"fixed":"ba57f430328534501962d60d651e385ffd7af9ca"},{"fixed":"850117b637bcb1dcc14be0cf09ac819a8707b42c"},{"fixed":"8db211aed83733073b0814adaeeab61d4521474e"},{"fixed":"64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"},{"fixed":"57c10915f2c16c90e0d46ad00876bf39ece40fc2"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64277.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.10.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64277.json"}}],"schema_version":"1.7.5"}