In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.12Upgrade linuxUpgrade linux-6.1 | Jul 28, 2026 | Jul 28, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 29, 2026 | Jul 25, 2026 |
| Rocky_linux | — | Upgrade kernel-rt-debug-kvmUpgrade python3-perf-debuginfoUpgrade rtlaUpgrade perfUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-coreUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-rt-kvmUpgrade kernel-debug-coreUpgrade bpftoolUpgrade kernelUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-uki-virtUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libsUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade rvUpgrade kernel-rt-modulesUpgrade bpftool-debuginfoUpgrade libperf-debuginfoUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extra-matchedUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-rtUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-x86_64 | Aug 28, 2026 | Aug 27, 2026 |
| Ubuntu | — | Upgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-realtime-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-7.0.0-31-genericUpgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-aws-64k-7.0Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-26.04bUpgrade linux-image-awsUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-realtimeUpgrade linux-image-raspi-7.0Upgrade linux-image-virtual-7.0Upgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-generic-7.0Upgrade linux-image-virtualUpgrade linux-image-gcp-7.0Upgrade linux-image-aws-64kUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-gcpUpgrade linux-image-gkeUpgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-gke-64k-7.0Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-nvidia-7.0Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-oem-26.04Upgrade linux-image-gke-7.0Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1013-oemUpgrade linux-image-ibmUpgrade linux-image-nvidia-bosUpgrade linux-image-realtime-7.0Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-gke-64kUpgrade linux-image-7.0.0-1012-awsUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-raspiUpgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-oem-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-oem-26.04aUpgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtime-64k-hwe-26.04 | Sep 14, 2026 | Sep 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 3, 2026 | Jul 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub