CVE-2026-80570 Input: synaptics-rmi4 - zero report size on F54 work error
A heap buffer overflow in the Synaptics RMI4 driver allows local attackers to execute arbitrary code or escalate privileges via crafted V4L2 format changes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80570?
CVE-2026-80570 is a high-severity memory corruption vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - zero report size on F54 work error
In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.
Which versions are affected by CVE-2026-80570?
How do I fix CVE-2026-80570?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80570 being exploited?
There is no known exploitation of CVE-2026-80570 in the wild and no public exploit code.
Sources
Also known as AZL-97703, BELL-CVE-2026-80570, DEBIAN-CVE-2026-80570, GHSA-x279-789v-7qx8, UBUNTU-CVE-2026-80570.