Linux Kernel EUVD-2026-66485

Exploitation requires all of the following: (1) local shell access with standard (low-privilege) user credentials on the target system; (2) Synaptics RMI4 touchpad hardware physically present or attached; (3) the synaptics-rmi4 kernel driver and F54 diagnostics module loaded and active; (4) attacker ability to open and manipulate V4L2 device nodes associated with the touchpad. The attacker must execute a specific two-phase sequence - seed report_size via a successful request, then trigger a failing request after shrinking the V4L2 buffer - making opportunistic exploitation harder than a single-packet attack. Limiting factors: the Synaptics RMI4 hardware requirement excludes server systems and most virtualized environments; udev-enforced device node permissions limit access to the V4L2 interface on hardened systems; and the driver is not loaded by default on server-oriented Linux distributions without the relevant hardware. No network access, no elevated privileges, and no victim user interaction are required.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a local privilege escalation requiring only standard user credentials, with genuinely low attack complexity once prerequisites are met. The two-phase trigger sequence - successful report request to seed report_size, then buffer shrink followed by a failing request - is deterministic and does not require race condition exploitation or brute force. EPSS data is absent from the available intelligence, preventing probabilistic exploitation comparison. KEV status is not confirmed and no POC is referenced, meaning no public exploit has been identified at time of analysis. The hardware dependency (Synaptics RMI4 touchpad physically present, driver loaded) inherently constrains the blast radius: server infrastructure and systems without this specific hardware are not affected, making mass automated exploitation impractical. However, the full High impact across Confidentiality, Integrity, and Availability reflects the realistic potential for kernel-level compromise on affected laptop fleets, and patch coverage across all supported stable branches makes remediation straightforward with no urgency tradeoff.

A local user on a laptop with the synaptics-rmi4 driver loaded opens the V4L2 interface for the F54 diagnostic function, performs a successful report request to establish a non-zero report_size, then reduces the V4L2 buffer format to a smaller allocation. A subsequent deliberately-failed report request bypasses the zeroing path, leaving the stale larger report_size in place. The next call to rmi_f54_buffer_queue() copies data sized to the stale value into the shrunken heap buffer, overflowing adjacent kernel heap objects - which can be leveraged for local privilege escalation to root. No public POC has been identified at time of analysis.