EUVD-2026-66483
GHSA-89jp-7748-46r4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access to the V4L2 device node requires low privilege; no complexity beyond timing the ioctl during active streaming; heap overflow enables full kernel memory corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers.
Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).
AnalysisAI
Heap buffer overflow in the Linux kernel's synaptics-rmi4 driver allows a local low-privileged user to trigger memory corruption by issuing VIDIOC_S_INPUT while the V4L2 diagnostic queue is actively streaming. The F54 function allocates V4L2 buffers sized to the report type at stream start; switching the input mid-stream to a larger report type overflows those buffers, enabling potential privilege escalation to root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system has Synaptics RMI4-compatible touchpad hardware physically present and detected by the kernel; (2) the synaptics-rmi4 kernel module is loaded and the F54 diagnostic function is available (not all RMI4 devices expose F54); (3) the attacker has a local account with read/write access to the V4L2 device node created by the F54 function - typically granted to members of the 'video' or 'input' group on desktop distributions; (4) streaming must be active on the V4L2 queue when VIDIOC_S_INPUT is issued. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) accurately reflects a local, low-complexity attack requiring only standard user-level access to the V4L2 device node - typically membership in the 'input' or 'video' group on a desktop Linux system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with access to the V4L2 device node exported by the synaptics-rmi4 F54 function opens the device and starts streaming diagnostic reports, then immediately issues a VIDIOC_S_INPUT ioctl to switch to a report type with a larger payload than the allocated buffers. The kernel writes the oversized report into the smaller heap buffer, overflowing into adjacent kernel heap memory and potentially enabling control-flow hijacking for privilege escalation to root. … |
| Remediation | The primary fix is to upgrade to a patched stable kernel release: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2, depending on the running branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running vulnerable Linux kernel versions with the synaptics-rmi4 driver enabled by reviewing kernel version and hardware configuration across your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today