CVE-2026-64276

CVE CVE-2026-64276EUVD EUVD-2026-48988Published 2026-07-25T08:49:21.000ZLast changed 2026-08-05T12:40:27.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 5.10.261; patch: 7.2-rc1; 4.14; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <8c6d18d61bb6fe0e6edf848413391c590552e8a9; patch: 6.12.96; patch: 6.6.145; patch: 5.15.212; patch: 7.1.4; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <bfe622efecd4ff0a792d0ecd1a8dce535a902f50; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <d162a1ead7de404d8b41a093c83ed0db6487cded; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <f0be9eba946e9200b43265e0a748d38bd0a56954; patch: 6.18.39; patch: 0; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <e849c6f51e6877104c765da084e001ec37c8e119; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <4e3689c26854356f41fbaa1eafa382e58ac79e00; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <26c895928d7118436a24f564587cb4aefc40cdd8; patch: 6.1.178; 3e64fcbdbd10e46dede502d507dbcc104837cd59 <d577e46785d45484b2ab7e7309c49b18764bf56c

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.