CVE-2026-80568

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. Changing the diagnostic report type while a video stream (V4L2) is active can alter the expected report size. Since V4L2 buffers are allocated based on the initial size at stream start, a larger subsequent report could lead to a heap buffer overflow. This vulnerability could allow a local attacker to potentially cause a denial of service or achieve arbitrary code execution.

A flaw of moderate severity was found in the Linux kernel's synaptics-rmi4 touchpad input driver. The driver exposes RMI4 function F54 diagnostic data through a V4L2 video device, and the V4L2 buffers are allocated based on the diagnostic report size in effect when streaming starts. A local attacker with access to the device's V4L2 interface could change the input (diagnostic report type) while a stream is active; because the newly selected report can be larger than the buffers allocated at stream start, this can result in a heap buffer overflow in kernel memory. The most likely consequence is memory corruption leading to a kernel panic and denial of service; arbitrary code execution is also theoretically possible. Red Hat rates the severity of this flaw as Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local attack vector and the availability-only impact of the most realistic outcome; this differs from the upstream CVE.org rating of Important (7.8), which assumes full confidentiality, integrity, and availability impact. Red Hat Enterprise Linux (including the kernel and kernel-rt components) and Red Hat In-Vehicle OS are not affected by this flaw, because the vulnerable code is not present in the shipped kernel packages of these products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.