Description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos. This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses. Fix the typos by correctly assigning the TX electrode counts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:15.120Z",
  "pubdate": "2026-09-03T13:06:15.120Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) memory access flaw located within the Linux kernel's synaptics-rmi4 driver, specifically during the F55 sensor detection phase.\nThe issue arises from a logic error where the transmitter (TX) electrode count is improperly initialized with the receiver (RX) electrode count due to a programming typo.\nThe primary impact is the corruption of internal driver data structures, which subsequently causes the F54 diagnostic reporting mechanism to perform incorrect memory allocation or size calculations.\nAttackers capable of triggering diagnostic reports on affected hardware could potentially induce an out-of-bounds read or write, leading to system instability, kernel panics, or potential privilege escalation via memory corruption.\nExploitation requires the device to have a configuration where the number of RX electrodes exceeds the number of TX electrodes, creating an inflated buffer size calculation.\nThe vulnerability affects the synaptics-rmi4 input subsystem; risk is contingent upon user-space access to the diagnostic interface.",
  "technicalDetails": "The vulnerability resides in the synaptics-rmi4 driver's handling of F55 sensor initialization. During the device enumeration and configuration process, the driver is responsible for parsing sensor geometry to define internal bounds for diagnostic data structures.\nThe root cause is a copy-paste error during the assignment of the transmitter (TX) electrode count. Instead of reading the correct TX electrode count from the device hardware registers or configuration descriptors, the code incorrectly assigns the value stored for the receiver (RX) electrode count to the TX electrode variable.\nThis incorrect value is subsequently propagated into the driver's internal state structures. Because the F54 component—which manages the diagnostics reports—relies on these structures to allocate buffers for diagnostic data, the calculation of the required memory footprint becomes fundamentally flawed.\nWhen a device possesses a higher number of RX electrodes than TX electrodes, the stored TX count is artificially inflated. This results in the driver requesting or preparing a buffer size that is significantly larger than the hardware-supported limit for TX electrodes. When the system attempts to write diagnostic report data into this buffer, it exceeds the intended bounds, potentially overwriting adjacent memory objects in kernel space.\nThe attack flow involves: 1) The driver performing the erroneous initialization upon sensor discovery. 2) The F54 module being triggered to generate a diagnostics report via standard input-subsystem ioctls or sysfs interfaces. 3) The kernel performing a buffer access using the inflated size parameter. 4) The out-of-bounds access occurring during the memory write operation.\nDepending on the memory layout and the kernel slab allocator, this OOB access could result in kernel memory corruption, leading to a Denial of Service (DoS) through a system crash or potentially enabling an attacker with sufficient privileges to overwrite critical kernel function pointers or data structures, leading to arbitrary code execution."
}