CVE-2026-64276 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
A local attacker with physical access or control over a Synaptics RMI4 device can trigger out-of-bounds memory access in the Linux kernel, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64276?
CVE-2026-64276 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Weakness: CWE-787
Which versions are affected by CVE-2026-64276?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64276?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64276 being exploited?
There is no known exploitation of CVE-2026-64276 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93614, BELL-CVE-2026-64276, DEBIAN-CVE-2026-64276, GHSA-7j4q-9mx8-7779, ROOT-OS-DEBIAN-12-CVE-2026-64276, ROOT-OS-UBUNTU-2204-CVE-2026-64276 and 1 more.