Linux Kernel EUVD-2026-66484

Exploitation requires: (1) the target system running an unpatched Linux kernel version with the synaptics-rmi4 driver loaded (present on systems with Synaptics RMI4 touchpads, common in laptops); (2) a malicious or malfunctioning RMI4 device that reports F55 electrode counts exceeding F54 electrode counts - this requires either physical insertion of a rogue device or firmware-level compromise of an existing touchpad; (3) the F55 function being active and reporting electrode counts (i.e., drv_data->num_*_electrodes being set). On conforming, well-behaved hardware, F55 configured electrodes are a subset of F54 physical electrodes and the condition is never triggered - so production systems with legitimate hardware are not at risk unless the hardware is tampered with. Exploitation is limited to local access and requires low OS-level privileges (PR:L per CVSS), but the hardware-level prerequisite is the dominant limiting factor. Remote exploitation is not possible.

The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high kernel-level impact with low attack complexity once a malicious device is present. However, the AC:L rating warrants scrutiny: exploiting this flaw requires either physical insertion of a rogue RMI4 device or prior compromise of the device's firmware to misreport F55 electrode counts - both are non-trivial preconditions that effectively raise practical attack complexity. EPSS data is not available for this CVE. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. SSVC signals: exploitation status is none/public, automatable is no (requires hardware interaction), technical impact is total if achieved. Real-world risk is moderate-to-elevated for affected hardware configurations (Linux laptops with Synaptics RMI4 touchpads in environments where hardware supply chain integrity is a concern) but low for general-purpose servers without this input hardware. The greatest practical risk scenario is physical access attacks in high-security environments or firmware supply chain abuse targeting specific laptop models.

An attacker with physical access to a Linux laptop equipped with a Synaptics RMI4 touchpad replaces or reprograms the touchpad firmware to report F55 electrode counts larger than the F54 counts. When the compromised device is connected and the kernel's rmi_f54_work() runs a diagnostics scan, the inflated report_size causes the read loop to write attacker-influenced data past the end of the report_data buffer in kernel memory, enabling kernel heap corruption that could be leveraged for local privilege escalation. No public proof-of-concept exploit has been identified at time of analysis.