CVE-2026-64277 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
A malicious or faulty Synaptics RMI4 device can trigger out-of-bounds reads and writes in the Linux kernel, leading to information disclosure or memory corruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64277?
CVE-2026-64277 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.
Which versions are affected by CVE-2026-64277?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64277?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64277 being exploited?
There is no known exploitation of CVE-2026-64277 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93476, BELL-CVE-2026-64277, DEBIAN-CVE-2026-64277, GHSA-p39g-x9xh-7wq9, ROOT-OS-DEBIAN-12-CVE-2026-64277, ROOT-OS-UBUNTU-2204-CVE-2026-64277 and 1 more.