Description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers. Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:12.303Z",
  "pubdate": "2026-08-26T15:17:12.303Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the Linux kernel's synaptics-rmi4 driver, specifically concerning the handling of V4L2 diagnostic reports.\nThe vulnerability arises from a race condition between the VIDIOC_S_INPUT ioctl and the active V4L2 streaming state. When an attacker modifies the input diagnostic report type while the device is actively streaming, the underlying report size may exceed the buffer limits previously allocated at stream initialization.\nThis flaw allows a local attacker with the ability to interact with the V4L2 interface to trigger a heap overflow. Successful exploitation can lead to memory corruption, potentially causing a system crash (Denial of Service) or facilitating arbitrary code execution within the kernel context.\nThe vulnerability is present in versions of the Linux kernel where the F54 function of the synaptics-rmi4 driver is exposed through the V4L2 subsystem. Mitigation requires strict state management to prevent configuration changes during active I/O operations.",
  "technicalDetails": "The root cause of this vulnerability is improper state synchronization in the Linux kernel's synaptics-rmi4 driver. The driver utilizes the V4L2 (Video4Linux2) framework to expose diagnostic report functionalities through the F54 function. V4L2 buffers are statically allocated based on the device's operational state at the time a stream is initiated.\nThe vulnerability occurs because the driver fails to validate the streaming state when the VIDIOC_S_INPUT ioctl is invoked. The VIDIOC_S_INPUT ioctl is responsible for switching between different diagnostic report types. These distinct report types inherently possess different payload sizes. If a user changes the report type while a streaming session is active, the driver may attempt to populate a buffer that was allocated based on the size requirements of the previous report type.\nThe attack flow proceeds as follows: 1) An attacker initiates a V4L2 streaming session, causing the kernel to allocate heap memory based on the current diagnostic report size. 2) The attacker sends a VIDIOC_S_INPUT command to the driver to switch to a different report type that requires a larger memory footprint. 3) The driver proceeds to process the new report type without reallocating the buffer or verifying if the existing buffer is sufficient. 4) The hardware or driver logic writes data into the insufficiently sized heap buffer, resulting in an out-of-bounds write.\nThe impacted component is the synaptics-rmi4 driver's integration with the V4L2 subsystem. Because this involves kernel-space heap memory, an out-of-bounds write can overwrite adjacent kernel structures, sensitive objects, or function pointers. This provides a vector for privilege escalation or kernel-level control if the attacker can influence the heap layout or exploit specific overwritten objects.\nThis vulnerability is reachable by local users or processes with sufficient permissions to access the corresponding V4L2 device nodes (e.g., /dev/video*). No specialized network access is required, as the attack vector is localized to the character device interface. Exploitation is deterministic provided the attacker can predict the buffer sizes associated with different input indices supported by the F54 queue."
}