Skip to main content

Linux Kernel CVE-2026-80754

| EUVDEUVD-2026-70358 HIGH
2026-09-03 Linux GHSA-v4rj-p772-hjqg
Buffer Overflow Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects the hardware-specific condition (RX > TX electrode count required); other metrics match vendor vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.8 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 05:35 vuln.today
CVSS changed
Sep 04, 2026 - 05:22 NVD
7.8 (HIGH)
Patch available
Sep 03, 2026 - 10:16 EUVD
CVE Published
Sep 03, 2026 - 08:26 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 03, 2026 - 08:26 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos.

This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses.

Fix the typos by correctly assigning the TX electrode counts.

AnalysisAI

Out-of-bounds buffer access in the Linux kernel's synaptics-rmi4 driver exposes systems with Synaptics RMI4 touchpad hardware to kernel memory corruption triggered by a copy-paste typo in F55 electrode initialization. On affected hardware where the receiver (RX) electrode count exceeds the transmitter (TX) count, the incorrectly propagated TX value causes F54 diagnostic routines to calculate an inflated report buffer size, enabling potential OOB reads or writes in kernel space. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the target system must run an unpatched Linux kernel with the synaptics-rmi4 driver loaded and bound to a Synaptics RMI4 touchpad or touchscreen device; (2) the specific hardware device must have a higher RX (receiver) electrode count than TX (transmitter) electrode count - hardware where TX >= RX is not vulnerable because the typo does not inflate the TX value; (3) the attacker must have local low-privilege access (PR:L) to trigger access to F54 diagnostic data, either through driver initialization or sysfs diagnostic reads. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects worst-case kernel memory corruption impact but must be contextualized against several mitigating factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Linux kernel to a patched stable release: 5.10.266 or later (5.10.x branch), 5.15.217 or later (5.15.x branch), 6.1.184 or later (6.1.x branch), 6.6.153 or later (6.6.x branch), 6.12.105 or later (6.12.x branch), 6.18.46 or later (6.18.x branch), 7.1.10 or later (7.1.x branch), or 7.2 or later (mainline). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Linux endpoints with Synaptics RMI4 touchpad hardware and cross-reference kernel versions against your asset inventory and patch management systems. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-80754 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy