CVE-2026-80570

A flaw was found in the synaptics-rmi4 component of the Linux kernel. This vulnerability occurs when an error in processing a report request or command leads to an incorrect size being used for subsequent data operations. A local user could exploit this by manipulating the video format, causing the system to attempt to write a larger amount of data than allocated. This results in a heap buffer overflow, which could lead to a system crash (Denial of Service) or potentially allow an attacker to execute unauthorized code.

A moderate-severity heap buffer overflow was found in the Synaptics RMI4 (synaptics-rmi4) touchpad driver of the Linux kernel, in the F54 diagnostics functionality exposed through V4L2. When rmi_f54_work() fails during a report request or command verification, the code previously jumped to an error path that skipped zeroing f54->report_size, leaving the previously successful payload size in place. A local user with access to the F54 V4L2 device could then change the video format to a smaller size and trigger another failed run, causing rmi_f54_buffer_queue() to copy the stale, larger payload into the shrunken V4L2 buffer and overflow heap memory. The most likely consequence is memory corruption leading to a kernel panic and denial of service. Red Hat rates this flaw moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because no practical path to code execution or privilege escalation has been established; this is lower than the upstream CVE record's important rating (CVSS 3.1 score 7.8), which assumes full confidentiality, integrity, and availability impact. Red Hat Product Security has determined that the vulnerable code is not present in any shipped version of the affected products: all Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS kernel streams are marked not affected for this reason, so no Red Hat update is required to address this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.