{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80570 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80570 is a high-severity memory corruption vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80570 and fix it if it is affected.\n\nWhat it is: CVE-2026-80570 is a high-severity memory corruption vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80570 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80570/ (Markdown: https://insights.sbomify.com/CVE-2026-80570/index.md)","id":"CVE-2026-80570","markdown":"https://insights.sbomify.com/CVE-2026-80570/index.md","name":"CVE-2026-80570","record":{"aliases":["AZL-97703","BELL-CVE-2026-80570","DEBIAN-CVE-2026-80570","GHSA-x279-789v-7qx8","UBUNTU-CVE-2026-80570"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A heap buffer overflow in the Synaptics RMI4 driver allows local attackers to execute arbitrary code or escalate privileges via crafted V4L2 format changes.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - zero report size on F54 work error\n\nIn rmi_f54_work(), if an error occurs during report request or command\nverification, the code jumped directly to the 'error' label, bypassing\nthe 'abort' label where f54-\u003ereport_size was normally zeroed out.\n\nThis left f54-\u003ereport_size containing its previous successful payload\nsize. If a user then altered the V4L2 format to a smaller size, and a\nsubsequent run failed, rmi_f54_buffer_queue() would copy the stale,\nlarger payload size into the shrunken V4L2 buffer, causing a heap\nbuffer overflow.\n\nFix this by merging the 'abort' and 'error' labels into a single 'out'\nexit path, and ensuring that f54-\u003ereport_size is always set to 0 on\nfailure by checking for error and zeroing the local report_size first.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Input: synaptics-rmi4 - zero report size on F54 work error","id":"CVE-2026-80570","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak","id":"CVE-2026-80571"},"packages":[],"prev":{"headline":"Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer","id":"CVE-2026-80569"},"products":["Linux"],"published":"2026-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-27","vendors":["Linux"]},"summary":"A heap buffer overflow in the Synaptics RMI4 driver allows local attackers to execute arbitrary code or escalate privileges via crafted V4L2 format changes.","url":"https://insights.sbomify.com/CVE-2026-80570/"}