{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80568", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.768Z", "datePublished": "2026-08-26T14:37:30.740Z", "dateUpdated": "2026-08-27T05:01:52.050Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:52.050Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - block s_input when F54 queue is busy\n\nChanging the input (diagnostic report type) mid-stream changes the\nreport size. Since V4L2 buffers are allocated based on the size at\nstream start, changing the input while streaming could lead to a\nheap buffer overflow if the new size is larger than the allocated\nbuffers.\n\nPrevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue\nis busy (streaming)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires issuing V4L2 ioctls (VIDIOC_S_INPUT, VIDIOC_STREAMON, VIDIOC_QBUF) on the /dev/v4l-touch* node created by the synaptics-rmi4 F54 diagnostics driver; reachable only from a local process with permission to open that character device, not over the network.\nAC:L - An attacker can deterministically start streaming with a smaller F54 report type, switch to a larger type via VIDIOC_S_INPUT while the vb2 queue is busy, then queue buffers to trigger the overflow; no winning of uncontrollable races or rare layout-dependent conditions is required.\nPR:L - The vulnerable path has no capability checks beyond standard DAC on /dev/v4l-touch*; on typical laptop/kiosk/Android deployments any unprivileged local user or app granted access to the V4L2 touch diagnostics node (commonly via the video group) can invoke the bug without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the device and issuing ioctl sequences; exploitation does not depend on another user plugging hardware, mounting filesystems, or performing GUI actions.\nS:U - The flaw corrupts kernel heap memory within the same host via vb2 vmalloc buffers in the F54 V4L2 driver; impact stays in the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - Changing the diagnostic input mid-stream makes rmi_f54_buffer_queue() memcpy() up to twice the originally allocated report size into undersized vmalloc-backed V4L2 buffers, a kernel heap out-of-bounds write that can expose or corrupt adjacent kernel memory.\nI:H - The oversized memcpy is a controlled kernel heap buffer overflow in rmi_f54_buffer_queue() that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.\nA:H - Writing far beyond the allocated V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops/panic or denial of service on affected laptops, kiosks, and embedded touch systems even without full exploit development."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "versions": [{"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "fa69f93015becf3729716de2199b58540aa99672", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "493ba8e794729649689438edba72337111303cc4", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "cae79513f9115c350561b16f36adcb47c9bfff12", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "ff0849705d29277fd1f6fc6596674b9308724fb2", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "ddd9a53faf3b65e5920cb802cb1db6f4615bdfef", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "fbfd76746adc16d64be29ff113f673b70bc3f5c2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af"}, {"url": "https://git.kernel.org/stable/c/fa69f93015becf3729716de2199b58540aa99672"}, {"url": "https://git.kernel.org/stable/c/493ba8e794729649689438edba72337111303cc4"}, {"url": "https://git.kernel.org/stable/c/1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac"}, {"url": "https://git.kernel.org/stable/c/cae79513f9115c350561b16f36adcb47c9bfff12"}, {"url": "https://git.kernel.org/stable/c/ff0849705d29277fd1f6fc6596674b9308724fb2"}, {"url": "https://git.kernel.org/stable/c/ddd9a53faf3b65e5920cb802cb1db6f4615bdfef"}, {"url": "https://git.kernel.org/stable/c/fbfd76746adc16d64be29ff113f673b70bc3f5c2"}], "title": "Input: synaptics-rmi4 - block s_input when F54 queue is busy", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "fa69f93015becf3729716de2199b58540aa99672", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "493ba8e794729649689438edba72337111303cc4", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "cae79513f9115c350561b16f36adcb47c9bfff12", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "ff0849705d29277fd1f6fc6596674b9308724fb2", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "ddd9a53faf3b65e5920cb802cb1db6f4615bdfef", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "fbfd76746adc16d64be29ff113f673b70bc3f5c2", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - block s_input when F54 queue is busy\n\nChanging the input (diagnostic report type) mid-stream changes the\nreport size. Since V4L2 buffers are allocated based on the size at\nstream start, changing the input while streaming could lead to a\nheap buffer overflow if the new size is larger than the allocated\nbuffers.\n\nPrevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue\nis busy (streaming)."}], "id": "CVE-2026-80568", "lastModified": "2026-08-27T06:17:41.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:12.303", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d718f1461766e9f00a8dbeb4f13f1b1c19d90ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/493ba8e794729649689438edba72337111303cc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e994a9ecc0b49ad2fe63da9c92a8aca8a6614af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cae79513f9115c350561b16f36adcb47c9bfff12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddd9a53faf3b65e5920cb802cb1db6f4615bdfef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa69f93015becf3729716de2199b58540aa99672"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fbfd76746adc16d64be29ff113f673b70bc3f5c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff0849705d29277fd1f6fc6596674b9308724fb2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Input: synaptics-rmi4 - block s_input when F54 queue is busy", "id": "2524490", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524490"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nInput: synaptics-rmi4 - block s_input when F54 queue is busy\nChanging the input (diagnostic report type) mid-stream changes the\nreport size. Since V4L2 buffers are allocated based on the size at\nstream start, changing the input while streaming could lead to a\nheap buffer overflow if the new size is larger than the allocated\nbuffers.\nPrevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue\nis busy (streaming).", "A flaw was found in the Linux kernel's `synaptics-rmi4` input driver. Changing the diagnostic report type while a video stream (V4L2) is active can alter the expected report size. Since V4L2 buffers are allocated based on the initial size at stream start, a larger subsequent report could lead to a heap buffer overflow. This vulnerability could allow a local attacker to potentially cause a denial of service or achieve arbitrary code execution."], "name": "CVE-2026-80568", "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80568\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80568\nhttps://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80568-d3e3@gregkh/T"], "threat_severity": "Moderate"}