CVE-2026-64277: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

rmif3ainitialize() takes the GPIO count from the device query register (f3a->gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127). rmif3amapgpios() then allocates gpiokeymap with min(gpiocount, TRACKSTICKRANGEEND) == at most 6 entries, but rmif3aattention() iterates the full gpiocount and dereferences gpiokeymap[i], and input->keycodemax is set to the full gpiocount while input->keycode points at the 6-entry allocation.

A device that reports gpiocount > 6 therefore causes an out-of-bounds read of gpiokeymap[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since inputdefaultgetkeycode() and inputdefaultsetkeycode() only bound the index against keycodemax.

Size the keymap for the full gpiocount. The mapping loop is unchanged: it still assigns only the first min(gpiocount, TRACKSTICKRANGEEND) entries; the remaining slots stay KEYRESERVED (devmkcalloc zero-fills) and are skipped when reporting.