CVE-2026-80568 (GCVE-0-2026-80568)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 05:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Changing the input (diagnostic report type) mid-stream changes the
report size. Since V4L2 buffers are allocated based on the size at
stream start, changing the input while streaming could lead to a
heap buffer overflow if the new size is larger than the allocated
buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue
is busy (streaming).
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "fa69f93015becf3729716de2199b58540aa99672",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "493ba8e794729649689438edba72337111303cc4",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "cae79513f9115c350561b16f36adcb47c9bfff12",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "ff0849705d29277fd1f6fc6596674b9308724fb2",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "ddd9a53faf3b65e5920cb802cb1db6f4615bdfef",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "fbfd76746adc16d64be29ff113f673b70bc3f5c2",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - block s_input when F54 queue is busy\n\nChanging the input (diagnostic report type) mid-stream changes the\nreport size. Since V4L2 buffers are allocated based on the size at\nstream start, changing the input while streaming could lead to a\nheap buffer overflow if the new size is larger than the allocated\nbuffers.\n\nPrevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue\nis busy (streaming)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires issuing V4L2 ioctls (VIDIOC_S_INPUT, VIDIOC_STREAMON, VIDIOC_QBUF) on the /dev/v4l-touch* node created by the synaptics-rmi4 F54 diagnostics driver; reachable only from a local process with permission to open that character device, not over the network.\nAC:L - An attacker can deterministically start streaming with a smaller F54 report type, switch to a larger type via VIDIOC_S_INPUT while the vb2 queue is busy, then queue buffers to trigger the overflow; no winning of uncontrollable races or rare layout-dependent conditions is required.\nPR:L - The vulnerable path has no capability checks beyond standard DAC on /dev/v4l-touch*; on typical laptop/kiosk/Android deployments any unprivileged local user or app granted access to the V4L2 touch diagnostics node (commonly via the video group) can invoke the bug without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the device and issuing ioctl sequences; exploitation does not depend on another user plugging hardware, mounting filesystems, or performing GUI actions.\nS:U - The flaw corrupts kernel heap memory within the same host via vb2 vmalloc buffers in the F54 V4L2 driver; impact stays in the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - Changing the diagnostic input mid-stream makes rmi_f54_buffer_queue() memcpy() up to twice the originally allocated report size into undersized vmalloc-backed V4L2 buffers, a kernel heap out-of-bounds write that can expose or corrupt adjacent kernel memory.\nI:H - The oversized memcpy is a controlled kernel heap buffer overflow in rmi_f54_buffer_queue() that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.\nA:H - Writing far beyond the allocated V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops/panic or denial of service on affected laptops, kiosks, and embedded touch systems even without full exploit development."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:52.050Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af"
},
{
"url": "https://git.kernel.org/stable/c/fa69f93015becf3729716de2199b58540aa99672"
},
{
"url": "https://git.kernel.org/stable/c/493ba8e794729649689438edba72337111303cc4"
},
{
"url": "https://git.kernel.org/stable/c/1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac"
},
{
"url": "https://git.kernel.org/stable/c/cae79513f9115c350561b16f36adcb47c9bfff12"
},
{
"url": "https://git.kernel.org/stable/c/ff0849705d29277fd1f6fc6596674b9308724fb2"
},
{
"url": "https://git.kernel.org/stable/c/ddd9a53faf3b65e5920cb802cb1db6f4615bdfef"
},
{
"url": "https://git.kernel.org/stable/c/fbfd76746adc16d64be29ff113f673b70bc3f5c2"
}
],
"title": "Input: synaptics-rmi4 - block s_input when F54 queue is busy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80568",
"datePublished": "2026-08-26T14:37:30.740Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-27T05:01:52.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…