CVE-2026-80569

A flaw was found in the synaptics-rmi4 driver within the Linux kernel. A malicious or malfunctioning RMI4 device can exploit this vulnerability by reporting incorrect electrode counts. This leads to the driver attempting to write data beyond the allocated memory buffer, causing memory corruption. This issue could potentially allow an attacker to impact system stability or integrity.

A moderate-severity out-of-bounds write was found in the synaptics-rmi4 touchscreen driver in the Linux kernel. The driver allocates the F54 diagnostics report buffer based on the F54 function's electrode counts, but rmi_f54_work() sizes the report transfer using electrode counts reported by the device's F55 function, and nothing constrains the F55 counts to the F54 ones. A malicious or malfunctioning RMI4 device can therefore report larger F55 electrode counts than its F54 counts, causing the driver to write data past the end of the allocated buffer and corrupt kernel memory, which can crash the system or otherwise impact its stability. On conforming hardware the F55 configured electrodes are a subset of the F54 physical electrodes, so well-behaved devices are not affected; exploiting this flaw requires an attacker to attach or control a specially crafted RMI4 device. All currently listed Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel, kernel-rt, and kernel-ivos-qualcomm streams have been assessed as not affected because the vulnerable code is not present in the shipped kernels. The Red Hat severity of moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) differs from the CVE.org score of 7.8, which additionally assumes high confidentiality and integrity impact; the Red Hat assessment reflects availability impact only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.