CVE-2026-80567: Linux Kernel Information Disclosure Vulnerability

CVE-2026-80567 Overview

CVE-2026-80567 is a Linux kernel vulnerability in the synaptics-rmi4 input driver. The flaw resides in the F54 diagnostic function's V4L2 video buffer queue handler. The rmi_f54_buffer_queue() function waited for a worker thread to complete but ignored the worker's return status. When the worker failed due to a register read failure or timeout, the queue thread returned success and delivered stale or uninitialized kernel memory to userspace. This is an information disclosure issue rooted in [CWE-908: Use of Uninitialized Resource] and improper error propagation.

Critical Impact
Userspace consumers of the V4L2 device could receive uninitialized kernel buffer contents when the synaptics-rmi4 F54 worker fails, enabling potential kernel memory disclosure to local processes.

Affected Products

Linux kernel builds containing the synaptics-rmi4 driver with F54 diagnostic support
Distributions shipping the affected drivers/input/rmi4/rmi_f54.c code prior to the referenced stable commits
Systems exposing the F54 V4L2 device node to unprivileged users

Discovery Timeline

2026-08-26 - CVE-2026-80567 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80567

Vulnerability Analysis

The synaptics-rmi4 driver implements the F54 analog diagnostic function as a Video4Linux2 (V4L2) device. When userspace queues a buffer via rmi_f54_buffer_queue(), the driver dispatches a worker thread to read raw diagnostic data from the touch controller's F54 registers. The queue handler then waits for the worker to finish before marking the buffer complete.

The defect stems from ignored error state. The worker could fail from a register read failure, a communication timeout, or an F54 command that never reported completion. The queue handler treated any completion as success. The buffer was marked VB2_BUF_STATE_DONE and returned to userspace even when the worker never populated it with valid data.

The fix introduces a report_error field in struct f54_data. The worker records its exit status in that field. rmi_f54_buffer_queue() inspects the field after the worker finishes and sets the buffer state to VB2_BUF_STATE_ERROR when the worker failed. This propagates the error to the V4L2 core and prevents delivery of the tainted buffer.

Root Cause

The root cause is missing error propagation between the F54 worker thread and the V4L2 queue callback. The original design synchronized only on completion, not on outcome. A failed worker left the buffer with whatever contents its slab page held before allocation, which is treated as an uninitialized resource condition.

Attack Vector

Exploitation requires local access to the F54 V4L2 device node and the ability to trigger F54 read failures or timeouts on the underlying touch controller. A local user with permission to open the device can queue buffers and read whatever residual kernel memory the failed worker leaves behind. No remote attack surface exists.

No verified public proof-of-concept exploit is available. See the Linux Kernel Commit 2b0403fb and related stable commits for the corrective patch.

Detection Methods for CVE-2026-80567

Indicators of Compromise

Kernel log entries from the rmi4_f54 driver reporting worker timeouts, register read failures, or F54 command errors immediately preceding V4L2 buffer dequeue by userspace
Unexpected access to /dev/video* nodes owned by the rmi4_f54 driver from processes that are not part of touch calibration or diagnostic workflows
Elevated frequency of failed F54 report generation on systems with Synaptics RMI4 touch controllers

Detection Strategies

Audit kernel version and driver source against the fixed commits listed under Patch Information to confirm exposure status.
Enable auditd rules on /dev/video* device nodes bound to the rmi4_f54 driver to record open, ioctl, and mmap operations by non-privileged users.
Correlate dmesg warnings from rmi4_f54 with contemporaneous V4L2 syscalls to identify sessions where a failed worker delivered a buffer to userspace.

Monitoring Recommendations

Ship kernel ring buffer and audit logs to a centralized data lake and alert on rmi4_f54 error strings paired with successful VIDIOC_DQBUF returns.
Track process behavior on systems with Synaptics touch hardware and flag unexpected consumers of F54 V4L2 devices.
Baseline expected F54 usage to service accounts used for calibration and treat other access as anomalous.

How to Mitigate CVE-2026-80567

Immediate Actions Required

Update the Linux kernel to a stable release that includes the F54 worker error propagation fix referenced in the commit list below.
Restrict permissions on F54 V4L2 device nodes so only privileged diagnostic tooling can open them.
Unload the rmi_f54 module on production systems that do not require touch diagnostics.

Patch Information

The fix adds a report_error field to struct f54_data and checks it in rmi_f54_buffer_queue(), marking the V4L2 buffer as VB2_BUF_STATE_ERROR on worker failure. The patch is present in the following stable commits: 2b0403fb, 305c24ee, 6741a8c2, 70f9aad3, 7d33b752, 8786d74b, 9bbd3682, and be56730b.

Workarounds

Blacklist the rmi_f54 module in /etc/modprobe.d/ on systems that do not use F54 diagnostics.
Tighten udev rules to set restrictive ownership and mode bits on V4L2 nodes created by rmi4_f54.
Restrict local user accounts and remove membership from the video group where F54 access is not required.

bash

# Blacklist the F54 module and restrict device node access
echo 'blacklist rmi_f54' | sudo tee /etc/modprobe.d/blacklist-rmi-f54.conf
sudo depmod -a

# Example udev rule limiting F54 V4L2 nodes to root
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-rmi4-f54.rules
SUBSYSTEM=="video4linux", ATTRS{name}=="Synaptics RMI4 F54", MODE="0600", OWNER="root"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger