CVE-2026-80567: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Previously, rmif54bufferqueue() waited for the worker thread to finish but ignored whether it succeeded. If the worker failed (e.g., due to a timeout or register read failure), the queue thread would silently return success, delivering stale or uninitialized memory to userspace.
Add a 'reporterror' field to struct f54data to store the worker's exit status. Check this field in rmif54bufferqueue() after the worker finishes, and mark the buffer as VB2BUFSTATEERROR if an error occurred.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel synaptics-rmi4 F54 path with its V4L2 buffer queue are exposed when the F54 worker encounters an error. The issue can result in stale or uninitialized memory being delivered to userspace.
What failure conditions can trigger the affected behavior?
The described examples are a worker timeout or a register read failure. Before the fix, rmi_f54_buffer_queue() waited for the worker but did not check whether it completed successfully.
How can the issue be identified or mitigated?
The fixed behavior records the worker exit status and marks the affected V4L2 buffer as VB2_BUF_STATE_ERROR when the worker fails. Applying a kernel version containing the referenced fixes prevents failed worker operations from being reported as successful buffers.