CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

rmif3ainitialize() takes the GPIO count from the device query register (f3a->gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127). rmif3amapgpios() then allocates gpiokeymap with min(gpiocount, TRACKSTICKRANGEEND) == at most 6 entries, but rmif3aattention() iterates the full gpiocount and dereferences gpiokeymap[i], and input->keycodemax is set to the full gpiocount while input->keycode points at the 6-entry allocation.

A device that reports gpiocount > 6 therefore causes an out-of-bounds read of gpiokeymap[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since inputdefaultgetkeycode() and inputdefault_setkeycode() only bound the index against keycodemax.

Size the keymap for the full gpiocount. The mapping loop is unchanged: it still assigns only the first min(gpiocount, TRACKSTICKRANGEEND) entries; the remaining slots stay KEYRESERVED (devmkcalloc zero-fills) and are skipped when reporting.