Look up another CVE · open CVE-2026-80568 in the interactive tracker
CVE-2026-80568
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem drivers/input. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-80568 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buffers. Prevent this by blocking VIDIOC_S_INPUT with -EBUSY if the V4L2 queue is busy (streaming).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/input/rmi4/rmi_f54.c
- What this is
- INPUT (KEYBOARD, MOUSE, JOYSTICK, TOUCHSCREEN) DRIVERSMAINTAINERS section matched on drivers/input/ · linux-input@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into rmi_core, and Debian does not compile it into that module, so finding rmi_core in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_INPUT|CONFIG_RMI4_CORE|CONFIG_RMI4_F54' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_INPUT, CONFIG_RMI4_CORE, CONFIG_RMI4_F54
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.19%, higher than 8.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/input
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.9 | 5.10.266 | 7e994a9ecc0b |
| 4.9 | 5.15.217 | fa69f93015be |
| 4.9 | 6.1.184 | 493ba8e79472 |
| 4.9 | 6.6.153 | 1d718f146176 |
| 4.9 | 6.12.105 | cae79513f911 |
| 4.9 | 6.18.46 | ff0849705d29 |
| 4.9 | 7.1.10 | ddd9a53faf3b |
| 4.9 | 7.2 | fbfd76746adc |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires issuing V4L2 ioctls (VIDIOC_S_INPUT, VIDIOC_STREAMON, VIDIOC_QBUF) on the /dev/v4l-touch* node created by the synaptics-rmi4 F54 diagnostics driver; reachable only from a local process with permission to open that character device, not over the network.
- AC:LAttack complexity, low
- An attacker can deterministically start streaming with a smaller F54 report type, switch to a larger type via VIDIOC_S_INPUT while the vb2 queue is busy, then queue buffers to trigger the overflow; no winning of uncontrollable races or rare layout-dependent conditions is required.
- PR:LPrivileges required, low
- The vulnerable path has no capability checks beyond standard DAC on /dev/v4l-touch*; on typical laptop/kiosk/Android deployments any unprivileged local user or app granted access to the V4L2 touch diagnostics node (commonly via the video group) can invoke the bug without real root in the init namespace.
- UI:NUser interaction, none
- No victim interaction is required beyond the attacker opening the device and issuing ioctl sequences; exploitation does not depend on another user plugging hardware, mounting filesystems, or performing GUI actions.
- S:UScope, unchanged
- The flaw corrupts kernel heap memory within the same host via vb2 vmalloc buffers in the F54 V4L2 driver; impact stays in the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.
- C:HConfidentiality impact, high
- Changing the diagnostic input mid-stream makes rmi_f54_buffer_queue() memcpy() up to twice the originally allocated report size into undersized vmalloc-backed V4L2 buffers, a kernel heap out-of-bounds write that can expose or corrupt adjacent kernel memory.
- I:HIntegrity impact, high
- The oversized memcpy is a controlled kernel heap buffer overflow in rmi_f54_buffer_queue() that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.
- A:HAvailability impact, high
- Writing far beyond the allocated V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops/panic or denial of service on affected laptops, kiosks, and embedded touch systems even without full exploit development.