Vulnerability-Lookup

CVE-2026-64276 (GCVE-0-2026-64276)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52

Title

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Summary

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6…
https://git.kernel.org/stable/c/d162a1ead7de404d8…
https://git.kernel.org/stable/c/f0be9eba946e9200b…
https://git.kernel.org/stable/c/26c895928d7118436…
https://git.kernel.org/stable/c/4e3689c26854356f4…
https://git.kernel.org/stable/c/e849c6f51e6877104…
https://git.kernel.org/stable/c/bfe622efecd4ff0a7…
https://git.kernel.org/stable/c/d577e46785d45484b…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 8c6d18d61bb6fe0e6edf848413391c590552e8a9 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < d162a1ead7de404d8b41a093c83ed0db6487cded (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < f0be9eba946e9200b43265e0a748d38bd0a56954 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 26c895928d7118436a24f564587cb4aefc40cdd8 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 4e3689c26854356f41fbaa1eafa382e58ac79e00 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < e849c6f51e6877104c765da084e001ec37c8e119 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < bfe622efecd4ff0a792d0ecd1a8dce535a902f50 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < d577e46785d45484b2ab7e7309c49b18764bf56c (git)	guessed
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f30.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c6d18d61bb6fe0e6edf848413391c590552e8a9",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "d162a1ead7de404d8b41a093c83ed0db6487cded",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "f0be9eba946e9200b43265e0a748d38bd0a56954",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "26c895928d7118436a24f564587cb4aefc40cdd8",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "4e3689c26854356f41fbaa1eafa382e58ac79e00",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "e849c6f51e6877104c765da084e001ec37c8e119",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "bfe622efecd4ff0a792d0ecd1a8dce535a902f50",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "d577e46785d45484b2ab7e7309c49b18764bf56c",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f30.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged local process that can open the affected /dev/input/event node can reach the flawed table through EVIOCGKEYCODE or EVIOCSKEYCODE; no physical reattachment or network path is required on systems with an affected F30 device.\nAC:L - Once an F30 device reports more than six GPIO/LEDs, attacker-selected indices deterministically trigger two-byte heap out-of-bounds reads or writes. No race or condition outside the attacker\u0027s control is required.\nPR:L - The evdev ioctl path contains no capability or namespace privilege check, so any ordinary user permitted to open the event node can trigger it.\nUI:N - The attacker directly issues the ioctls, and the separate attention path is device-driven; neither requires action by another user.\nS:U - The vulnerable driver and the affected kernel memory share the same security authority. Kernel privilege escalation or code execution does not itself cross a VM, IOMMU, or other scope boundary.\nC:H - EVIOCGKEYCODE returns attacker-selected out-of-bounds u16 values and can disclose multiple adjacent slab words across the available indices. This heap disclosure can expose security-sensitive kernel data and facilitate further exploitation.\nI:H - EVIOCSKEYCODE performs attacker-controlled u16 writes beyond the allocation at selectable offsets. These writes can corrupt adjacent heap objects or metadata and plausibly enable control-flow hijacking.\nA:H - The controlled heap corruption can damage adjacent kernel objects and cause an oops or panic, while the device can also repeatedly trigger the out-of-bounds attention path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:31.046Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954"
        },
        {
          "url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00"
        },
        {
          "url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50"
        },
        {
          "url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"
        }
      ],
      "title": "Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64276",
    "datePublished": "2026-07-25T08:49:21.300Z",
    "dateReserved": "2026-07-19T15:36:31.776Z",
    "dateUpdated": "2026-08-17T04:52:31.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64276",
      "date": "2026-09-15",
      "epss": "0.00169",
      "percentile": "0.06518"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:42:46.000Z",
      "cve": "CVE-2026-64276",
      "id": "msrc_CVE-2026-64276",
      "initial_release_date": "2026-07-26T01:12:06.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64276.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64276\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:08.060\",\"lastModified\":\"2026-08-17T05:17:26.747\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\\n\\nrmi_f30_map_gpios() allocates gpioled_key_map with\\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\\nregister, range 0..31) and dereferences gpioled_key_map[i], and\\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\\npoints at the 6-entry allocation.\\n\\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\\ntherefore causes an out-of-bounds read on the attention interrupt and\\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\\nwhich bound the index only against keycodemax. This is the same defect\\nas the F3A handler, which was copied from F30.\\n\\nSize the keymap for the full gpioled_count; the mapping loop still\\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/rmi4/rmi_f30.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"8c6d18d61bb6fe0e6edf848413391c590552e8a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"d162a1ead7de404d8b41a093c83ed0db6487cded\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"f0be9eba946e9200b43265e0a748d38bd0a56954\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"26c895928d7118436a24f564587cb4aefc40cdd8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"4e3689c26854356f41fbaa1eafa382e58ac79e00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"e849c6f51e6877104c765da084e001ec37c8e119\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"bfe622efecd4ff0a792d0ecd1a8dce535a902f50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e64fcbdbd10e46dede502d507dbcc104837cd59\",\"lessThan\":\"d577e46785d45484b2ab7e7309c49b18764bf56c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/rmi4/rmi_f30.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.1\",\"versionEndExcluding\":\"5.10.261\",\"matchCriteriaId\":\"8EFB0D87-39D4-43FF-BE77-BEE0C5BE4EEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.212\",\"matchCriteriaId\":\"8E99FB01-CD93-41AF-A653-3F450652B9A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.178\",\"matchCriteriaId\":\"092233C7-F4E0-40C8-BD4D-A28FE50DFE20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.145\",\"matchCriteriaId\":\"7046B092-F810-4440-ACE6-60218518EECE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.96\",\"matchCriteriaId\":\"38A8100E-2B1A-462F-AEE9-8901B870FEF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.39\",\"matchCriteriaId\":\"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"6228DDD6-4557-4AA3-9F43-AB995D471E42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7875AA30-1F6F-470C-A52D-ECBD6663CEC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.14:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C834B5F2-810F-4291-8E1F-1B32635E08F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.14:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB4A96BC-72CC-4EF1-916C-9ED7177C196E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-07T19:38:03+00:00",
      "cve": "CVE-2026-64276",
      "id": "CVE-2026-64276",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64276.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T17:12:22Z",
      "cve": "CVE-2026-64276",
      "id": "CVE-2026-64276",
      "initial_release_date": "2026-07-25T16:46:47Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "171",
      "product_status:recommended": "149",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64276",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64276.json",
      "version": "6"
    }
  }
}

FKIE_CVE-2026-64276

Vulnerability from fkie_nvd - Published: 2026-07-25 10:17 - Updated: 2026-08-17 05:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	4.14
linux	linux_kernel	4.14
linux	linux_kernel	4.14

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f30.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c6d18d61bb6fe0e6edf848413391c590552e8a9",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "d162a1ead7de404d8b41a093c83ed0db6487cded",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "f0be9eba946e9200b43265e0a748d38bd0a56954",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "26c895928d7118436a24f564587cb4aefc40cdd8",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "4e3689c26854356f41fbaa1eafa382e58ac79e00",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "e849c6f51e6877104c765da084e001ec37c8e119",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "bfe622efecd4ff0a792d0ecd1a8dce535a902f50",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "d577e46785d45484b2ab7e7309c49b18764bf56c",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f30.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EFB0D87-39D4-43FF-BE77-BEE0C5BE4EEB",
              "versionEndExcluding": "5.10.261",
              "versionStartIncluding": "4.14.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
              "versionEndExcluding": "5.15.212",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
              "versionEndExcluding": "6.1.178",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
              "versionEndExcluding": "6.6.145",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
              "versionEndExcluding": "6.12.96",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
              "versionEndExcluding": "6.18.39",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*",
              "matchCriteriaId": "7875AA30-1F6F-470C-A52D-ECBD6663CEC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.14:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "C834B5F2-810F-4291-8E1F-1B32635E08F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.14:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "BB4A96BC-72CC-4EF1-916C-9ED7177C196E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries."
    }
  ],
  "id": "CVE-2026-64276",
  "lastModified": "2026-08-17T05:17:26.747",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-25T10:17:08.060",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-7J4Q-9MX8-7779

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30

Details

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation.

A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64276"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:08Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.",
  "id": "GHSA-7j4q-9mx8-7779",
  "modified": "2026-07-27T06:30:31Z",
  "published": "2026-07-25T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64276"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-64276

Vulnerability from csaf_microsoft - Published: 2026-07-26 01:12 - Updated: 2026-07-27 14:42

Summary

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Scope

1 vulnerability in this advisory, including CVE-2026-64276.

CVE-2026-64276

Known affected: 1 product

Open the full advisory

OPENSUSE-SU-2026:11476-1

Vulnerability from csaf_opensuse - Published: 2026-08-09 00:00 - Updated: 2026-08-09 00:00

Summary

kernel-devel-7.1.7-1.1 on GA media

Severity

Moderate

Scope

351 vulnerabilities in this advisory, including CVE-2026-64276.

CVE-2026-64276

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 16 products

Open the full advisory

RHSA-2026:59723

Vulnerability from csaf_opensuse - Published: 2026-08-26 06:06 - Updated: 2026-09-15 11:39

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

13 vulnerabilities in this advisory, including CVE-2026-64276.

CVE-2026-64276

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write to unauthorized memory regions. This could result in information disclosure or potentially allow for further system compromise.

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 303 products

https://access.redhat.com/errata/RHSA-2026:59723

Open the full advisory

RHSA-2026:59737

Vulnerability from csaf_redhat - Published: 2026-08-26 04:08 - Updated: 2026-09-15 11:39

Summary

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-64276.

CVE-2026-64276

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 30 products

https://access.redhat.com/errata/RHSA-2026:59737

Open the full advisory

RHSA-2026:59821

Vulnerability from csaf_redhat - Published: 2026-08-26 05:57 - Updated: 2026-09-15 11:39

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-64276.

CVE-2026-64276

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 120 products

https://access.redhat.com/errata/RHSA-2026:59821

Open the full advisory

RHSA-2026:61887

Vulnerability from csaf_redhat - Published: 2026-09-01 08:34 - Updated: 2026-09-14 23:48

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

34 vulnerabilities in this advisory, including CVE-2026-64276.

CVE-2026-64276

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 309 products

https://access.redhat.com/errata/RHSA-2026:61887

Open the full advisory

rlsa-2026:59723

Vulnerability from osv_rocky

Published

2026-08-27 12:05

Modified

2026-09-10 12:13

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

[Rocky Linux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:Rocky Linux-166118)
ss core dumped when there is an SCTP session [rhel-9.8.z] (JIRA:Rocky Linux-212398)
[IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [rhel-9.8.z] (JIRA:Rocky Linux-245333)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:59723	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2422696	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2432681	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2466994	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492095	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492112	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492735	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492747	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492770	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502872	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502889	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507290	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507301	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2520980	REPORT
	https://access.redhat.com/errata/RHSA-2026:59723	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.42.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:59723"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)\n\n* kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)\n\n* kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry (CVE-2026-43114)\n\n* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)\n\n* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)\n\n* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)\n\n* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n\n* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)\n\n* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)\n\n* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)\n\n* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)\n\n* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)\n\n* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer (CVE-2026-74581)\n\nBug Fix(es) and Enhancement(s):\n\n* [Rocky Linux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:Rocky Linux-166118)\n\n* ss core dumped when there is an SCTP session [rhel-9.8.z] (JIRA:Rocky Linux-212398)\n\n* [IBM 9.9 FEAT] zcrypt driver overwrite  function - kernel part [rhel-9.8.z] (JIRA:Rocky Linux-245333)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:59723",
  "modified": "2026-09-10T12:13:06.570753Z",
  "published": "2026-08-27T12:05:26.997131Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:59723"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422696"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432681"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466994"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492112"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492735"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492770"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502872"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502889"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507290"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507301"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520980"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:59723"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2025-68211",
    "CVE-2026-23003",
    "CVE-2026-43114",
    "CVE-2026-52920",
    "CVE-2026-52924",
    "CVE-2026-53131",
    "CVE-2026-53185",
    "CVE-2026-53268",
    "CVE-2026-64189",
    "CVE-2026-64191",
    "CVE-2026-64276",
    "CVE-2026-64277",
    "CVE-2026-74581"
  ]
}

rlsa-2026:59737

Vulnerability from osv_rocky

Published

2026-08-27 12:02

Modified

2026-09-10 12:13

Summary

Important: kernel-rt security, bug fix, and enhancement update

Details

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

Bug Fix(es) and Enhancement(s):

[Rocky Linux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:Rocky Linux-178088)
SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:Rocky Linux-222800)
ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:Rocky Linux-212400)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:59737	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2492095	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502438	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502872	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502889	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507061	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507290	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507301	REPORT
	https://access.redhat.com/errata/RHSA-2026:59737	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel-rt",
        "purl": "pkg:rpm/rocky-linux/kernel-rt?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "NFV"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.158.1.rt7.499.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:59737"
  },
  "details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)\n\n* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)\n\n* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)\n\n* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)\n\n* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)\n\n* kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)\n\n* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)\n\n* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)\n\nBug Fix(es) and Enhancement(s):\n\n* [Rocky Linux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:Rocky Linux-178088)\n\n* SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:Rocky Linux-222800)\n\n* ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:Rocky Linux-212400)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:59737",
  "modified": "2026-09-10T12:13:06.430374Z",
  "published": "2026-08-27T12:02:32.959504Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:59737"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502438"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502872"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502889"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507061"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507290"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507301"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:59737"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel-rt security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-52924",
    "CVE-2026-63886",
    "CVE-2026-63913",
    "CVE-2026-64189",
    "CVE-2026-64191",
    "CVE-2026-64276",
    "CVE-2026-64277",
    "CVE-2026-64320"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-64276 (GCVE-0-2026-64276)

Vulnerability from osv_rocky

Vulnerability from osv_rocky

Tags

Sightings

Nomenclature