CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.

A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

The Linux kernel CVE team has assigned CVE-2026-64276 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 5.10.261 with commit 8c6d18d61bb6fe0e6edf848413391c590552e8a9
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 5.15.212 with commit d162a1ead7de404d8b41a093c83ed0db6487cded
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.1.178 with commit f0be9eba946e9200b43265e0a748d38bd0a56954
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.6.145 with commit 26c895928d7118436a24f564587cb4aefc40cdd8
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.12.96 with commit 4e3689c26854356f41fbaa1eafa382e58ac79e00
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.18.39 with commit e849c6f51e6877104c765da084e001ec37c8e119
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 7.1.4 with commit bfe622efecd4ff0a792d0ecd1a8dce535a902f50
	Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 7.2-rc1 with commit d577e46785d45484b2ab7e7309c49b18764bf56c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64276
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/input/rmi4/rmi_f30.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9
	https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded
	https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954
	https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8
	https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00
	https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119
	https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50
	https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c