CVE-2026-80570: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80570 Overview

CVE-2026-80570 is a heap buffer overflow vulnerability in the Linux kernel's synaptics-rmi4 input driver. The flaw resides in the rmi_f54_work() function, which handles Function 54 (F54) diagnostic report processing for Synaptics RMI4 touchpads. When an error occurs during report request or command verification, execution jumps to the error label and bypasses the abort label that zeroes f54->report_size. The stale size value then causes rmi_f54_buffer_queue() to copy oversized data into a shrunken V4L2 buffer. Local authenticated users can trigger the condition by manipulating the V4L2 format and forcing a failed diagnostic run.

Critical Impact
Local privileged users can trigger a kernel heap buffer overflow leading to memory corruption, potential privilege escalation, or denial of service.

Affected Products

Linux kernel versions containing the synaptics-rmi4 driver with the F54 diagnostic module
Distributions shipping affected stable kernel branches referenced in the upstream fix commits
Systems with Synaptics RMI4 touchpads exposing the V4L2 diagnostic interface

Discovery Timeline

2026-08-26 - CVE-2026-80570 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80570

Vulnerability Analysis

The vulnerability is a heap buffer overflow [CWE-122] in the Synaptics RMI4 F54 diagnostic reporting path. The synaptics-rmi4 driver exposes touchpad diagnostic data through a V4L2 video interface, allowing userspace to request raw sensor reports. The f54->report_size field tracks the expected payload size for the current V4L2 buffer geometry.

Under normal operation, rmi_f54_work() reaches the abort label on failure, which zeroes report_size before returning. The buggy control flow jumped directly to the error label on report request or command verification failures, skipping the reset. The previous successful payload size therefore persisted in f54->report_size.

An attacker with local access reduces the V4L2 format to a smaller frame size, shrinking the allocated buffer. A subsequent failing diagnostic run leaves the stale, larger report_size intact. When rmi_f54_buffer_queue() executes, it copies report_size bytes into the smaller destination buffer, overflowing the heap allocation and corrupting adjacent kernel memory.

Root Cause

The root cause is inconsistent error-path cleanup. Two labels (abort and error) diverged in their handling of f54->report_size, so specific failure branches bypassed the size reset. The upstream fix merges both labels into a single out exit path and explicitly zeroes the local report_size on error before assigning it to the shared structure.

Attack Vector

Exploitation requires local access with permissions to open the V4L2 device node exposed by the driver. The attacker performs three steps: issue a successful F54 report request to prime f54->report_size, reduce the V4L2 format to shrink the backing buffer, then trigger a failing report request. The next buffer queue operation copies the stale size into the undersized buffer, producing a controlled heap overflow suitable for kernel exploitation. See the upstream fix commit for the corrected control flow.

Detection Methods for CVE-2026-80570

Indicators of Compromise

Unexpected kernel oops, KASAN slab-out-of-bounds reports, or panics referencing rmi_f54_buffer_queue or rmi_f54_work
Kernel log entries showing repeated F54 report request failures followed by V4L2 buffer activity from unprivileged processes
Local processes opening the RMI4 V4L2 device and iteratively calling VIDIOC_S_FMT with shrinking dimensions

Detection Strategies

Enable CONFIG_KASAN on test systems to catch heap out-of-bounds writes originating in the F54 code path
Audit open() and ioctl() syscalls against /dev/video* nodes bound to the synaptics_rmi4 driver from non-root user contexts
Correlate kernel ring buffer messages containing rmi4_f54 errors with subsequent buffer queue calls in the same process context

Monitoring Recommendations

Ship dmesg and journald kernel logs to a central data lake and alert on synaptics_rmi4 error patterns
Track kernel version inventory across endpoints to identify hosts still running unpatched synaptics-rmi4 code
Monitor for privilege escalation indicators such as unexpected setuid invocations following V4L2 device activity

How to Mitigate CVE-2026-80570

Immediate Actions Required

Apply the vendor-provided stable kernel update containing the merged out exit path in rmi_f54_work()
Restrict access to the affected V4L2 device nodes to trusted users through udev rules or group permissions
If patching is deferred, unload the rmi_f54 module on systems that do not require touchpad diagnostics

Patch Information

The fix is available in the upstream stable trees. Refer to the following commits: 62079c17, 77749685, 79521ed3, 88c8174d, b28593a0, c669c64a, c6cfda79, and dc76c3c8. Rebuild and reboot into the patched kernel on all affected hosts.

Workarounds

Blacklist the rmi_f54 module on systems that do not use Synaptics touchpad diagnostics
Tighten permissions on /dev/video* nodes owned by the RMI4 driver to prevent unprivileged access
Enforce kernel hardening options such as CONFIG_SLAB_FREELIST_HARDENED and CONFIG_FORTIFY_SOURCE to raise exploitation cost

bash

# Blacklist the vulnerable module until patched
echo "blacklist rmi_f54" | sudo tee /etc/modprobe.d/blacklist-rmi_f54.conf
sudo rmmod rmi_f54 2>/dev/null || true
sudo update-initramfs -u