CVE-2026-80570 (GCVE-0-2026-80570)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
Input: synaptics-rmi4 - zero report size on F54 work error
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow. Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 62079c17ec07d64362bec367ee7a525b0dbf6bf9 (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 79521ed3cc9ea48476666ccacf45ecd6954b29a4 (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < c669c64ab71afa7b467c4d7e18f6a05e96b97a1f (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 77749685e55da19b187df215b5da4080842ca5c7 (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < c6cfda79f26c69e97db9805808c3b44d02227b4b (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < b28593a05afdd812b590e1045b5bd862a5869225 (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < 88c8174d72900d77fbdf2f527d54b6ff2da876a8 (git)
Affected: 3a762dbd5347514c3cb2ac756a92a3d1c7646a2d , < dc76c3c8e8ad09362b8c1561f3928288c15cba2e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f54.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "62079c17ec07d64362bec367ee7a525b0dbf6bf9",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "79521ed3cc9ea48476666ccacf45ecd6954b29a4",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "c669c64ab71afa7b467c4d7e18f6a05e96b97a1f",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "77749685e55da19b187df215b5da4080842ca5c7",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "c6cfda79f26c69e97db9805808c3b44d02227b4b",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "b28593a05afdd812b590e1045b5bd862a5869225",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "88c8174d72900d77fbdf2f527d54b6ff2da876a8",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            },
            {
              "lessThan": "dc76c3c8e8ad09362b8c1561f3928288c15cba2e",
              "status": "affected",
              "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f54.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - zero report size on F54 work error\n\nIn rmi_f54_work(), if an error occurs during report request or command\nverification, the code jumped directly to the \u0027error\u0027 label, bypassing\nthe \u0027abort\u0027 label where f54-\u003ereport_size was normally zeroed out.\n\nThis left f54-\u003ereport_size containing its previous successful payload\nsize. If a user then altered the V4L2 format to a smaller size, and a\nsubsequent run failed, rmi_f54_buffer_queue() would copy the stale,\nlarger payload size into the shrunken V4L2 buffer, causing a heap\nbuffer overflow.\n\nFix this by merging the \u0027abort\u0027 and \u0027error\u0027 labels into a single \u0027out\u0027\nexit path, and ensuring that f54-\u003ereport_size is always set to 0 on\nfailure by checking for error and zeroing the local report_size first."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local V4L2 ioctls on the synaptics-rmi4 F54 diagnostics node (/dev/v4l-touch*); open/STREAMON/QBUF drives rmi_f54_buffer_queue() memcpy() using stale f54-\u003ereport_size. There is no network, Bluetooth, or physical-bus injection path to this code.\nAC:L - An attacker can capture a large F54 report, stop streaming, switch VIDIOC_S_INPUT to a smaller report type, then re-stream and retry until rmi_f54_work() takes the error goto (timeout or register-read failure); ioctl timing is attacker-controlled and no uncontrollable victim state is required.\nPR:L - Triggering the overflow needs only permission to open the registered VFL_TYPE_TOUCH device and issue standard V4L2 capture ioctls; on typical laptop, kiosk, and Android deployments this is granted to unprivileged local users via video/input device policy without init-namespace root.\nUI:N - No cooperative victim action is required; the attacker opens the diagnostics node, performs the capture/input-change/re-stream sequence, and queues buffers themselves. No other user must mount filesystems, plug devices, or perform GUI actions at exploit time.\nS:U - The flaw corrupts kernel heap memory via vb2 vmalloc buffers in the F54 V4L2 driver on the same host; impact stays within the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - On worker failure f54-\u003ereport_size retains the prior successful payload size, so memcpy() can write up to roughly twice the newly allocated V4L2 buffer into adjacent vmalloc heap memory, enabling disclosure or corruption of neighboring kernel objects.\nI:H - The stale-size memcpy in rmi_f54_buffer_queue() is a controlled kernel heap buffer overflow that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.\nA:H - Writing far beyond the shrunken V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops or panic on affected laptops, kiosks, and embedded touch systems even without full exploit development."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:54.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/62079c17ec07d64362bec367ee7a525b0dbf6bf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/79521ed3cc9ea48476666ccacf45ecd6954b29a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c669c64ab71afa7b467c4d7e18f6a05e96b97a1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/77749685e55da19b187df215b5da4080842ca5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6cfda79f26c69e97db9805808c3b44d02227b4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b28593a05afdd812b590e1045b5bd862a5869225"
        },
        {
          "url": "https://git.kernel.org/stable/c/88c8174d72900d77fbdf2f527d54b6ff2da876a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc76c3c8e8ad09362b8c1561f3928288c15cba2e"
        }
      ],
      "title": "Input: synaptics-rmi4 - zero report size on F54 work error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80570",
    "datePublished": "2026-08-26T14:37:31.940Z",
    "dateReserved": "2026-08-26T14:34:25.768Z",
    "dateUpdated": "2026-08-27T05:01:54.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80570",
      "date": "2026-09-01",
      "epss": "0.00134",
      "percentile": "0.03228"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80570\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:12.880\",\"lastModified\":\"2026-08-27T06:17:42.377\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: synaptics-rmi4 - zero report size on F54 work error\\n\\nIn rmi_f54_work(), if an error occurs during report request or command\\nverification, the code jumped directly to the \u0027error\u0027 label, bypassing\\nthe \u0027abort\u0027 label where f54-\u003ereport_size was normally zeroed out.\\n\\nThis left f54-\u003ereport_size containing its previous successful payload\\nsize. If a user then altered the V4L2 format to a smaller size, and a\\nsubsequent run failed, rmi_f54_buffer_queue() would copy the stale,\\nlarger payload size into the shrunken V4L2 buffer, causing a heap\\nbuffer overflow.\\n\\nFix this by merging the \u0027abort\u0027 and \u0027error\u0027 labels into a single \u0027out\u0027\\nexit path, and ensuring that f54-\u003ereport_size is always set to 0 on\\nfailure by checking for error and zeroing the local report_size first.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/rmi4/rmi_f54.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"62079c17ec07d64362bec367ee7a525b0dbf6bf9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"79521ed3cc9ea48476666ccacf45ecd6954b29a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"c669c64ab71afa7b467c4d7e18f6a05e96b97a1f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"77749685e55da19b187df215b5da4080842ca5c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"c6cfda79f26c69e97db9805808c3b44d02227b4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"b28593a05afdd812b590e1045b5bd862a5869225\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"88c8174d72900d77fbdf2f527d54b6ff2da876a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d\",\"lessThan\":\"dc76c3c8e8ad09362b8c1561f3928288c15cba2e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/rmi4/rmi_f54.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/62079c17ec07d64362bec367ee7a525b0dbf6bf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/77749685e55da19b187df215b5da4080842ca5c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79521ed3cc9ea48476666ccacf45ecd6954b29a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/88c8174d72900d77fbdf2f527d54b6ff2da876a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b28593a05afdd812b590e1045b5bd862a5869225\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c669c64ab71afa7b467c4d7e18f6a05e96b97a1f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c6cfda79f26c69e97db9805808c3b44d02227b4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc76c3c8e8ad09362b8c1561f3928288c15cba2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T13:38:50+00:00",
      "cve": "CVE-2026-80570",
      "id": "CVE-2026-80570",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: synaptics-rmi4 - zero report size on F54 work error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80570.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.