{"id":"CVE-2026-64277","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-07-25","updated":"2026-07-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64277","references":[{"url":"https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64277.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64277"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507290"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64277"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64277"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64277-34e2@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:61887"},{"url":"https://access.redhat.com/errata/RHSA-2026:59723"},{"url":"https://access.redhat.com/errata/RHSA-2026:59821"},{"url":"https://access.redhat.com/errata/RHSA-2026:59737"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00169,"epssPercentile":0.06594,"ingestedAt":"2026-07-27T06:16:49.802Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 9","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_rt_v_8","enterprise_linux_real_time_v_9"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_rt_v_8","enterprise_linux_real_time_v_9"],"cwe":["CWE-125"],"scores":{"nvd":7.8,"vendor":6.4},"slug":"CVE-2026-64277","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input->keycodemax is set to the full gpio_count\nwhile input->keycode points at the 6-entry allocation.\n\nA device that reports gpio_count > 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core's default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:61887** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61887)\n- **RHSA-2026:59723** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:59723)\n- **RHSA-2026:59821** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:59821)\n- **RHSA-2026:59737** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:59737)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64277.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}