CVE-2026-80568 Input: synaptics-rmi4 - block s_input when F54 queue is busy
A heap buffer overflow in the Synaptics RMI4 driver allows attackers to execute arbitrary code or escalate privileges by changing input types during streaming.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80568?
CVE-2026-80568 is a high-severity memory corruption vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).
Which versions are affected by CVE-2026-80568?
How do I fix CVE-2026-80568?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80568 being exploited?
There is no known exploitation of CVE-2026-80568 in the wild and no public exploit code.
Sources
Also known as AZL-97686, BELL-CVE-2026-80568, DEBIAN-CVE-2026-80568, GHSA-89jp-7748-46r4, UBUNTU-CVE-2026-80568.