CVE-2026-80569: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80569 Overview

CVE-2026-80569 affects the Linux kernel's synaptics-rmi4 input driver. The rmi_f54_work() function reads a diagnostics report from an RMI4 device into a buffer allocated at probe time using F54 electrode counts. However, the transfer size is computed from F55 electrode counts, which are not constrained to match the F54 values. A malicious or malfunctioning RMI4 device that reports larger F55 electrode counts than F54 counts triggers an out-of-bounds write into f54->report_data and a subsequent out-of-bounds read during the V4L2 dequeue memcpy().

Critical Impact
A local attacker with a crafted or compromised RMI4 device can write past a heap buffer in the Linux kernel, corrupting adjacent memory and potentially escalating privileges or destabilizing the system.

Affected Products

Linux kernel synaptics-rmi4 input driver (rmi_f54 module)
Multiple stable branches referenced by upstream fix commits
Systems using Synaptics touch controllers exposing the F54 diagnostics function

Discovery Timeline

2026-08-26 - CVE-2026-80569 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80569

Vulnerability Analysis

The defect is an out-of-bounds write [CWE-787] in the Synaptics RMI4 F54 diagnostics handler. At driver probe, report_data is allocated based on F54's electrode counts using array3_size(f54->num_tx_electrodes, f54->num_rx_electrodes, sizeof(u16)). At runtime, rmi_f54_get_report_size() computes the transfer length from drv_data->num_*_electrodes, which are populated from the F55 function when present.

Both F54 and F55 electrode counts are read directly from device queries, and each can report up to 255 electrodes. Nothing in the driver enforces that F55 counts are a subset of F54 counts. When F55 reports larger values, the read loop in rmi_f54_work() writes beyond the allocation boundary. The subsequent V4L2 dequeue memcpy() then reads past the same buffer, exposing kernel memory contents.

Compliant hardware treats F55 configured electrodes as a subset of F54 physical electrodes, so real devices remain unaffected. The exploitation surface is limited to physically attached or emulated RMI4 devices under adversary control.

Root Cause

The driver trusts device-reported metadata without validating that the runtime-computed report_size fits within the buffer allocated at probe. The mismatch between the allocation source (F54 counts) and the sizing source (F55 counts) creates the boundary violation. The fix records the allocation size and rejects any report that does not fit, mirroring the existing zero-size check.

Attack Vector

Exploitation requires local access with the ability to introduce or emulate a malicious RMI4 device, for example through USB, I2C, or a virtualized peripheral. The device advertises inflated F55 electrode counts so that the driver's F54 diagnostics path writes past f54->report_data. Successful exploitation corrupts kernel heap memory adjacent to the buffer and can be chained with kernel heap grooming to achieve privilege escalation.

No verified public exploit is available. Refer to the upstream commits such as Kernel Git Commit 12be3c6 and Kernel Git Commit b7b9a8b1 for the fix implementation.

Detection Methods for CVE-2026-80569

Indicators of Compromise

Unexpected kernel oops or panic messages referencing rmi_f54_work, rmi_f54, or synaptics_rmi4 in dmesg or journalctl -k.
KASAN slab-out-of-bounds reports naming report_data or the F54 report path on kernels built with sanitizers.
Newly enumerated RMI4 or HID input devices reporting anomalously large electrode counts.

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to catch the out-of-bounds write on first occurrence.
Audit loaded kernel modules with lsmod | grep rmi and correlate module load events with new device attach events in system logs.
Monitor for unauthorized peripheral attachments on systems that do not normally use Synaptics touch controllers.

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on crashes originating in drivers/input/rmi4.
Track kernel version and patch level across the fleet to identify hosts still running vulnerable builds.
Baseline expected input device inventory per host class and alert on deviations, especially in kiosk, laptop, and embedded fleets.

How to Mitigate CVE-2026-80569

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 12be3c6, 42eaf0e6, 49c5adc2, 6b06aab7, 6b3bdd44, b2f596f0, b3932101, and b7b9a8b1 as backported by your distribution.
Restrict physical and virtual peripheral access on systems exposing the synaptics-rmi4 driver.
Prioritize patching endpoints and mobile devices that ship with Synaptics touch hardware.

Patch Information

The fix records the allocation size for report_data at probe and rejects any report whose size exceeds that allocation, mirroring the driver's existing zero-size guard. Distributions are shipping backports across supported stable branches. See Kernel Git Commit 42eaf0e6 and Kernel Git Commit b3932101 for the reference implementations.

Workarounds

Blacklist the rmi_core and rmi_f54 modules on systems that do not require Synaptics diagnostics functionality.
Enforce USB and I2C device allowlisting through kernel policy or udev rules to block unauthorized RMI4 peripherals.
Disable exposure of the V4L2 dequeue interface tied to F54 diagnostics where operationally acceptable.

bash

# Blacklist the affected module until patches are deployed
echo "blacklist rmi_f54" | sudo tee /etc/modprobe.d/blacklist-rmi-f54.conf
echo "blacklist rmi_core" | sudo tee -a /etc/modprobe.d/blacklist-rmi-f54.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep rmi