CVE-2026-80568: Input: synaptics-rmi4 - block s_input when F54 queue is busy
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - block sinput when F54 queue is busy
Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers.
Prevent this by blocking VIDIOCSINPUT with -EBUSY if the V4L2 queue is busy (streaming).
Event History
Frequently Asked Questions
What conditions are required to trigger the overflow?
An attacker or local process must be able to change the V4L2 input, which selects the diagnostic report type, while the F54 V4L2 queue is streaming. The newly selected report type must require a larger report size than the buffers allocated when streaming began.
How can I determine whether a system is vulnerable?
A vulnerable driver permits VIDIOC_S_INPUT while the F54 V4L2 queue is busy or streaming. The resolved behavior rejects that ioctl with -EBUSY during streaming.
What can be done if the fix cannot be applied immediately?
Do not allow diagnostic report input changes while F54 V4L2 streaming is active. Stop streaming before changing the input or diagnostic report type, then restart streaming after buffers are allocated for the selected report size.