CVE-2026-64277 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, system administrators responsible for Linux kernel updates, security teams monitoring Linux kernel vulnerabilities

Why it matters

The Linux kernel vulnerability in the synaptics-rmi4 driver allows local users to leak memory or write arbitrary values, requiring immediate attention from Linux kernel developers, maintainers, and system administrators.

• Local users may be able to leak sensitive information from adjacent slab memory
• Local users may be able to write arbitrary values to kernel memory
• Verification of Linux kernel versions and patch application is necessary
• Exposure assessment and monitoring of affected systems are required

Technical summary

The Linux kernel's synaptics-rmi4 driver was vulnerable to out-of-bounds read and write due to an incorrectly sized keymap. The keymap was not properly bounded to the GPIO count, allowing local users to leak adjacent slab memory or write arbitrary values. The vulnerability was resolved by sizing the keymap for the full gpio_count. This fix prevents local users from exploiting the vulnerability to leak sensitive information or write arbitrary values to kernel memory. The fix was applied in Linux kernel versions 5.10.262, 5.15.213, 5.16.179, 6.1.179, 6.6.146, 6.7, 6.12.97, and 6.18.40 or later.

Defensive priority

High

Recommended defensive actions

• Assess exposure for Linux kernel deployments using the synaptics-rmi4 driver
• Verify and apply patches from Linux kernel maintainers
• Monitor for unusual activity on affected systems
• Update Linux kernel to version 5.10.262 or later, 5.15.213 or later, 5.16.179 or later, 6.1.179 or later, 6.6.146 or later, 6.7 or later, 6.12.97 or later, or 6.18.40 or later
• Perform compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced in the Linux kernel's synaptics-rmi4 driver, which did not properly bound the F3A keymap to the GPIO count. This was resolved by sizing the keymap for the full gpio_count.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.