CVE-2026-80754

A flaw was found in the Linux kernel's Synaptics RMI4 driver. During F55 sensor detection, a copy-paste error caused the transmitter (TX) electrode count to be incorrectly assigned the receiver (RX) electrode count. This miscalculation can lead to incorrect diagnostics report sizes and potential out-of-bounds buffer accesses. This could allow a local attacker to cause a denial of service or potentially execute arbitrary code.

An out of bounds buffer access risk exists in the Synaptics RMI4 F55 and F54 path because the TX electrode count can be incorrectly copied from the RX electrode count. The wrong TX value is propagated into driver data and can make F54 calculate an incorrect diagnostic report size on devices with more RX than TX electrodes. The most direct impact is a local or physical denial of service through a kernel crash on affected hardware. For the CVSS the PR:L is used for the paranoid score because a local user or service may be able to trigger F54 diagnostics or interact with an already present RMI4 device, while direct remote network triggering is not supported. In the worst still defensible case, the out of bounds access may represent kernel memory corruption and could allow confidentiality or integrity impact in addition to availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.