{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80570","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.768Z","datePublished":"2026-08-26T14:37:31.940Z","dateUpdated":"2026-08-27T05:01:54.209Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-27T05:01:54.209Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - zero report size on F54 work error\n\nIn rmi_f54_work(), if an error occurs during report request or command\nverification, the code jumped directly to the 'error' label, bypassing\nthe 'abort' label where f54->report_size was normally zeroed out.\n\nThis left f54->report_size containing its previous successful payload\nsize. If a user then altered the V4L2 format to a smaller size, and a\nsubsequent run failed, rmi_f54_buffer_queue() would copy the stale,\nlarger payload size into the shrunken V4L2 buffer, causing a heap\nbuffer overflow.\n\nFix this by merging the 'abort' and 'error' labels into a single 'out'\nexit path, and ensuring that f54->report_size is always set to 0 on\nfailure by checking for error and zeroing the local report_size first."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local V4L2 ioctls on the synaptics-rmi4 F54 diagnostics node (/dev/v4l-touch*); open/STREAMON/QBUF drives rmi_f54_buffer_queue() memcpy() using stale f54->report_size. There is no network, Bluetooth, or physical-bus injection path to this code.\nAC:L - An attacker can capture a large F54 report, stop streaming, switch VIDIOC_S_INPUT to a smaller report type, then re-stream and retry until rmi_f54_work() takes the error goto (timeout or register-read failure); ioctl timing is attacker-controlled and no uncontrollable victim state is required.\nPR:L - Triggering the overflow needs only permission to open the registered VFL_TYPE_TOUCH device and issue standard V4L2 capture ioctls; on typical laptop, kiosk, and Android deployments this is granted to unprivileged local users via video/input device policy without init-namespace root.\nUI:N - No cooperative victim action is required; the attacker opens the diagnostics node, performs the capture/input-change/re-stream sequence, and queues buffers themselves. No other user must mount filesystems, plug devices, or perform GUI actions at exploit time.\nS:U - The flaw corrupts kernel heap memory via vb2 vmalloc buffers in the F54 V4L2 driver on the same host; impact stays within the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - On worker failure f54->report_size retains the prior successful payload size, so memcpy() can write up to roughly twice the newly allocated V4L2 buffer into adjacent vmalloc heap memory, enabling disclosure or corruption of neighboring kernel objects.\nI:H - The stale-size memcpy in rmi_f54_buffer_queue() is a controlled kernel heap buffer overflow that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.\nA:H - Writing far beyond the shrunken V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops or panic on affected laptops, kiosks, and embedded touch systems even without full exploit development."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/input/rmi4/rmi_f54.c"],"versions":[{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"62079c17ec07d64362bec367ee7a525b0dbf6bf9","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"79521ed3cc9ea48476666ccacf45ecd6954b29a4","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"c669c64ab71afa7b467c4d7e18f6a05e96b97a1f","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"77749685e55da19b187df215b5da4080842ca5c7","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"c6cfda79f26c69e97db9805808c3b44d02227b4b","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"b28593a05afdd812b590e1045b5bd862a5869225","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"88c8174d72900d77fbdf2f527d54b6ff2da876a8","status":"affected","versionType":"git"},{"version":"3a762dbd5347514c3cb2ac756a92a3d1c7646a2d","lessThan":"dc76c3c8e8ad09362b8c1561f3928288c15cba2e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/input/rmi4/rmi_f54.c"],"versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","status":"unaffected","versionType":"semver"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.10","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.10.266"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.12.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.18.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/62079c17ec07d64362bec367ee7a525b0dbf6bf9"},{"url":"https://git.kernel.org/stable/c/79521ed3cc9ea48476666ccacf45ecd6954b29a4"},{"url":"https://git.kernel.org/stable/c/c669c64ab71afa7b467c4d7e18f6a05e96b97a1f"},{"url":"https://git.kernel.org/stable/c/77749685e55da19b187df215b5da4080842ca5c7"},{"url":"https://git.kernel.org/stable/c/c6cfda79f26c69e97db9805808c3b44d02227b4b"},{"url":"https://git.kernel.org/stable/c/b28593a05afdd812b590e1045b5bd862a5869225"},{"url":"https://git.kernel.org/stable/c/88c8174d72900d77fbdf2f527d54b6ff2da876a8"},{"url":"https://git.kernel.org/stable/c/dc76c3c8e8ad09362b8c1561f3928288c15cba2e"}],"title":"Input: synaptics-rmi4 - zero report size on F54 work error","x_generator":{"engine":"bippy-1.2.0"}}}}