EUVD-2026-66485
GHSA-x279-789v-7qx8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local V4L2 interface access requires low-privilege shell; kernel is the vulnerable component so no scope change; full C/I/A impact reflects kernel heap overflow exploitation potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - zero report size on F54 work error
In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out.
This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow.
Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.
AnalysisAI
Heap buffer overflow in the Linux kernel synaptics-rmi4 driver allows local low-privileged users to overwrite kernel heap memory by exploiting stale state in the F54 diagnostics function. Affected systems must have Synaptics RMI4 touchpad hardware present and the driver loaded; exploitation involves manipulating V4L2 buffer sizes to trigger the overflow after an error condition leaves f54->report_size containing a stale value from a prior successful operation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local shell access with standard (low-privilege) user credentials on the target system; (2) Synaptics RMI4 touchpad hardware physically present or attached; (3) the synaptics-rmi4 kernel driver and F54 diagnostics module loaded and active; (4) attacker ability to open and manipulate V4L2 device nodes associated with the touchpad. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a local privilege escalation requiring only standard user credentials, with genuinely low attack complexity once prerequisites are met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a laptop with the synaptics-rmi4 driver loaded opens the V4L2 interface for the F54 diagnostic function, performs a successful report request to establish a non-zero report_size, then reduces the V4L2 buffer format to a smaller allocation. A subsequent deliberately-failed report request bypasses the zeroing path, leaving the stale larger report_size in place. … |
| Remediation | Upgrade to a patched stable kernel release: 5.10.266 or later, 5.15.217 or later, 6.1.184 or later, 6.6.153 or later, 6.12.105 or later, 6.18.46 or later, 7.1.10 or later, or 7.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems in your infrastructure with Synaptics RMI4 touchpad hardware present (check hardware inventory and verify synaptics_rmi4 driver is loaded); correlate your current kernel versions against the Linux vendor security advisory for CVE-2026-80570 to identify affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today