Answer in brief
CVE-2026-64277 records a High severity (CVSS 7.8) vulnerability in Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9e4c596bfd004f447a652205163234dfd4aafa69 <502ad7caaa1a445b734c827fa256e5311df67e3d || >=9e4c596bfd004f447a652205163234dfd4aafa69 <3480e24bc4e178aaa009edb25b6ee12df199e210 || >=9e4c596bfd004f447a652205163234dfd4aafa69 <35ed74d32d8260bdfb14a94caf402bf0866bdeec || >=9e4c596bfd004f447a652205163234dfd4aafa69 <ba57f430328534501962d60d651e385ffd7af9ca || >=9e4c596bfd004f447a652205163234dfd4aafa69 <850117b637bcb1dcc14be0cf09ac819a8707b42c || >=9e4c596bfd004f447a652205163234dfd4aafa69 <8db211aed83733073b0814adaeeab61d4521474e || >=9e4c596bfd004f447a652205163234dfd4aafa69 <64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42 || >=9e4c596bfd004f447a652205163234dfd4aafa69 <57c10915f2c16c90e0d46ad00876bf39ece40fc2 | 502ad7caaa1a445b734c827fa256e5311df67e3d, 3480e24bc4e178aaa009edb25b6ee12df199e210, 35ed74d32d8260bdfb14a94caf402bf0866bdeec, ba57f430328534501962d60d651e385ffd7af9ca, 850117b637bcb1dcc14be0cf09ac819a8707b42c, 8db211aed83733073b0814adaeeab61d4521474e, 64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42, 57c10915f2c16c90e0d46ad00876bf39ece40fc2 |
| Linux/Linuxgeneric | 5.10 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.
Quoted source text, attributed separately from HOL analysis.