Linux Kernel CVE-2026-80568

Exploitation requires: (1) the target system has Synaptics RMI4-compatible touchpad hardware physically present and detected by the kernel; (2) the synaptics-rmi4 kernel module is loaded and the F54 diagnostic function is available (not all RMI4 devices expose F54); (3) the attacker has a local account with read/write access to the V4L2 device node created by the F54 function - typically granted to members of the 'video' or 'input' group on desktop distributions; (4) streaming must be active on the V4L2 queue when VIDIOC_S_INPUT is issued. Exploitation is NOT possible remotely, over the network, or on systems without the relevant Synaptics hardware. It does NOT require root or administrator privileges, but DOES require local interactive or shell access. Non-default configuration is not required beyond having the hardware present and the driver loaded.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) accurately reflects a local, low-complexity attack requiring only standard user-level access to the V4L2 device node - typically membership in the 'input' or 'video' group on a desktop Linux system. The impact metrics (C:H/I:H/A:H) are consistent with a heap overflow that could enable full privilege escalation. EPSS data was not provided in source intelligence, so exploitation probability cannot be quantified. This CVE is not listed in CISA KEV and no public POC has been identified, which meaningfully reduces immediate operational urgency compared to its CVSS score alone. The attack surface is constrained: the synaptics-rmi4 F54 diagnostic V4L2 interface is present only on systems with compatible Synaptics RMI4 hardware and the driver loaded, making this a non-issue on servers and virtual machines. Even a mid-sized municipal IT team managing a fleet of Linux laptops should treat this as a standard patch-cycle priority rather than an emergency, given the absence of known active exploitation. The most realistic exploitation scenario involves a local unprivileged user or a compromised user-space process on a laptop with a Synaptics touchpad.

A local user with access to the V4L2 device node exported by the synaptics-rmi4 F54 function opens the device and starts streaming diagnostic reports, then immediately issues a VIDIOC_S_INPUT ioctl to switch to a report type with a larger payload than the allocated buffers. The kernel writes the oversized report into the smaller heap buffer, overflowing into adjacent kernel heap memory and potentially enabling control-flow hijacking for privilege escalation to root. No public POC has been identified, but the fix and root cause are fully public in the stable kernel commits.