CVE-2026-80754: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos.
This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
Event History
Frequently Asked Questions
Which systems are most likely to be exposed to the out-of-bounds access risk?
Systems using the Linux synaptics-rmi4 driver on hardware where the F55 sensor has more receiver (RX) than transmitter (TX) electrodes are affected by the incorrect count calculation. The issue can cause F54 diagnostic report sizes to be calculated too large.
What activity reaches the affected code path?
The incorrect TX count is established during F55 sensor detection and is subsequently used when F54 determines diagnostics report size. The provided information does not identify any separate attacker-controlled input or prerequisite beyond use of the affected driver and diagnostic reporting path.
How can an administrator determine whether a device has the problematic hardware condition?
Check whether the Synaptics RMI4 device uses F55 sensor detection and has a receiver electrode count greater than its transmitter electrode count. That RX-greater-than-TX condition is the one identified as producing an inflated TX count and incorrect diagnostic report sizing.