Bug 2507301 (CVE-2026-64276)

Summary:	CVE-2026-64276 kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write to unauthorized memory regions. This could result in information disclosure or potentially allow for further system compromise.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-25 10:15:20 UTC

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.

A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

Comment 1 TEJ RATHI 2026-07-27 05:50:03 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64276-b80d@gregkh/T

Comment 4 errata-xmlrpc 2026-08-26 03:58:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:59737 https://access.redhat.com/errata/RHSA-2026:59737

Comment 5 errata-xmlrpc 2026-08-26 04:35:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:59723 https://access.redhat.com/errata/RHSA-2026:59723

Comment 6 errata-xmlrpc 2026-08-26 05:34:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:59821 https://access.redhat.com/errata/RHSA-2026:59821

Comment 7 errata-xmlrpc 2026-09-01 07:31:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:61887 https://access.redhat.com/errata/RHSA-2026:61887