From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC3E433260C for ; Sat, 25 Jul 2026 08:51:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969497; cv=none; b=NjQp3KbzKksFspY16JV+DJxnMyyDNW7meGln8xUfJ7gEwg//3turaH0ZmL98QDwgvqbarWicIPBVweYK68ZdjsNzTZ3XtOHrVsyH/Rw60PdPHojgUiGrG6eyA7z4Vmmir+eEZ1YqQYcJlCKXOV6+CSn+AQ16qIMHj30y67SjxtA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969497; c=relaxed/simple; bh=QM7cWNVvmuqG8Wr0hWsGBEILuoxUb95l3XwX4HRSbTI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ambs1pGmiKhbcK3SLEgS3XuBiPkeHe+rj1FAmQRBqxGwTinnBJdlwbpjKBXyGPGQZ5MQXrF8EBunCREweTOeIJnApVNFmHaicF3fQbi6ZYh37IDRUsptu6pGZxwn704IWEJeGLe8o7rsyfhlWRQCvMvXeEhBKlJ2/OQIiKzq7Ls= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Zcq10Q9O; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Zcq10Q9O" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF9F41F000E9; Sat, 25 Jul 2026 08:51:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784969495; bh=ivvFdvImRaRozpEhO/IYRKNuPHLsacGAFhcIE2K3ti4=; h=From:To:Cc:Subject:Date:Reply-To; b=Zcq10Q9OMqAhGyiLIe9Wp0xBjpq8OlbFKeFxeK9/GMOuWVFoUgOdVC0jyXjKQ9IdZ Vlzk1kJGLyQRy8BO7VRKgvGhbeiop0p/9wVaEIn85vzLxp78FNrHUywhowXkysOE0h ghQ0/4bMvGpFp3YkWmERpa98ivM5A6zgrFV1eUdU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Date: Sat, 25 Jul 2026 10:48:13 +0200 Message-ID: <2026072501-CVE-2026-64276-b80d@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3997; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=s4vCX05AEeAem6RBkFoBqPHQINI4swKhAWlMF9J9Isw=; b=kA0DAAIRMUfUDdst+ykByyZiAGpkeEGiPglGVzWgdCvnYK1REyWw/rmbLSG7P3IKOKL1Kbgg8 4hdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmpkeEEACgkQMUfUDdst+ymxSQCfYrdT /dJLr6emca+ormKl0I+dcPMAnizcbCo+uRRbhhhrB6TM2QBxFJmK X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries. The Linux kernel CVE team has assigned CVE-2026-64276 to this issue. Affected and fixed versions =========================== Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 5.10.261 with commit 8c6d18d61bb6fe0e6edf848413391c590552e8a9 Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 5.15.212 with commit d162a1ead7de404d8b41a093c83ed0db6487cded Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.1.178 with commit f0be9eba946e9200b43265e0a748d38bd0a56954 Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.6.145 with commit 26c895928d7118436a24f564587cb4aefc40cdd8 Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.12.96 with commit 4e3689c26854356f41fbaa1eafa382e58ac79e00 Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 6.18.39 with commit e849c6f51e6877104c765da084e001ec37c8e119 Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 7.1.4 with commit bfe622efecd4ff0a792d0ecd1a8dce535a902f50 Issue introduced in 4.14 with commit 3e64fcbdbd10e46dede502d507dbcc104837cd59 and fixed in 7.2-rc1 with commit d577e46785d45484b2ab7e7309c49b18764bf56c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64276 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/input/rmi4/rmi_f30.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9 https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954 https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8 https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00 https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119 https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50 https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c