CVE-2026-80570 (GCVE-0-2026-80570)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 05:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - zero report size on F54 work error
In rmi_f54_work(), if an error occurs during report request or command
verification, the code jumped directly to the 'error' label, bypassing
the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload
size. If a user then altered the V4L2 format to a smaller size, and a
subsequent run failed, rmi_f54_buffer_queue() would copy the stale,
larger payload size into the shrunken V4L2 buffer, causing a heap
buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out'
exit path, and ensuring that f54->report_size is always set to 0 on
failure by checking for error and zeroing the local report_size first.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d Version: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62079c17ec07d64362bec367ee7a525b0dbf6bf9",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "79521ed3cc9ea48476666ccacf45ecd6954b29a4",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "c669c64ab71afa7b467c4d7e18f6a05e96b97a1f",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "77749685e55da19b187df215b5da4080842ca5c7",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "c6cfda79f26c69e97db9805808c3b44d02227b4b",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "b28593a05afdd812b590e1045b5bd862a5869225",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "88c8174d72900d77fbdf2f527d54b6ff2da876a8",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
},
{
"lessThan": "dc76c3c8e8ad09362b8c1561f3928288c15cba2e",
"status": "affected",
"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_f54.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - zero report size on F54 work error\n\nIn rmi_f54_work(), if an error occurs during report request or command\nverification, the code jumped directly to the \u0027error\u0027 label, bypassing\nthe \u0027abort\u0027 label where f54-\u003ereport_size was normally zeroed out.\n\nThis left f54-\u003ereport_size containing its previous successful payload\nsize. If a user then altered the V4L2 format to a smaller size, and a\nsubsequent run failed, rmi_f54_buffer_queue() would copy the stale,\nlarger payload size into the shrunken V4L2 buffer, causing a heap\nbuffer overflow.\n\nFix this by merging the \u0027abort\u0027 and \u0027error\u0027 labels into a single \u0027out\u0027\nexit path, and ensuring that f54-\u003ereport_size is always set to 0 on\nfailure by checking for error and zeroing the local report_size first."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local V4L2 ioctls on the synaptics-rmi4 F54 diagnostics node (/dev/v4l-touch*); open/STREAMON/QBUF drives rmi_f54_buffer_queue() memcpy() using stale f54-\u003ereport_size. There is no network, Bluetooth, or physical-bus injection path to this code.\nAC:L - An attacker can capture a large F54 report, stop streaming, switch VIDIOC_S_INPUT to a smaller report type, then re-stream and retry until rmi_f54_work() takes the error goto (timeout or register-read failure); ioctl timing is attacker-controlled and no uncontrollable victim state is required.\nPR:L - Triggering the overflow needs only permission to open the registered VFL_TYPE_TOUCH device and issue standard V4L2 capture ioctls; on typical laptop, kiosk, and Android deployments this is granted to unprivileged local users via video/input device policy without init-namespace root.\nUI:N - No cooperative victim action is required; the attacker opens the diagnostics node, performs the capture/input-change/re-stream sequence, and queues buffers themselves. No other user must mount filesystems, plug devices, or perform GUI actions at exploit time.\nS:U - The flaw corrupts kernel heap memory via vb2 vmalloc buffers in the F54 V4L2 driver on the same host; impact stays within the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - On worker failure f54-\u003ereport_size retains the prior successful payload size, so memcpy() can write up to roughly twice the newly allocated V4L2 buffer into adjacent vmalloc heap memory, enabling disclosure or corruption of neighboring kernel objects.\nI:H - The stale-size memcpy in rmi_f54_buffer_queue() is a controlled kernel heap buffer overflow that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.\nA:H - Writing far beyond the shrunken V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops or panic on affected laptops, kiosks, and embedded touch systems even without full exploit development."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:54.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62079c17ec07d64362bec367ee7a525b0dbf6bf9"
},
{
"url": "https://git.kernel.org/stable/c/79521ed3cc9ea48476666ccacf45ecd6954b29a4"
},
{
"url": "https://git.kernel.org/stable/c/c669c64ab71afa7b467c4d7e18f6a05e96b97a1f"
},
{
"url": "https://git.kernel.org/stable/c/77749685e55da19b187df215b5da4080842ca5c7"
},
{
"url": "https://git.kernel.org/stable/c/c6cfda79f26c69e97db9805808c3b44d02227b4b"
},
{
"url": "https://git.kernel.org/stable/c/b28593a05afdd812b590e1045b5bd862a5869225"
},
{
"url": "https://git.kernel.org/stable/c/88c8174d72900d77fbdf2f527d54b6ff2da876a8"
},
{
"url": "https://git.kernel.org/stable/c/dc76c3c8e8ad09362b8c1561f3928288c15cba2e"
}
],
"title": "Input: synaptics-rmi4 - zero report size on F54 work error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80570",
"datePublished": "2026-08-26T14:37:31.940Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-27T05:01:54.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…