CVE-2026-80570

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires local V4L2 ioctls on the synaptics-rmi4 F54 diagnostics node (/dev/v4l-touch*); open/STREAMON/QBUF drives rmi_f54_buffer_queue() memcpy() using stale f54->report_size. There is no network, Bluetooth, or physical-bus injection path to this code.

AC:LAttack complexity, low

An attacker can capture a large F54 report, stop streaming, switch VIDIOC_S_INPUT to a smaller report type, then re-stream and retry until rmi_f54_work() takes the error goto (timeout or register-read failure); ioctl timing is attacker-controlled and no uncontrollable victim state is required.

PR:LPrivileges required, low

Triggering the overflow needs only permission to open the registered VFL_TYPE_TOUCH device and issue standard V4L2 capture ioctls; on typical laptop, kiosk, and Android deployments this is granted to unprivileged local users via video/input device policy without init-namespace root.

UI:NUser interaction, none

No cooperative victim action is required; the attacker opens the diagnostics node, performs the capture/input-change/re-stream sequence, and queues buffers themselves. No other user must mount filesystems, plug devices, or perform GUI actions at exploit time.

S:UScope, unchanged

The flaw corrupts kernel heap memory via vb2 vmalloc buffers in the F54 V4L2 driver on the same host; impact stays within the kernel security authority and does not by itself cross VM, IOMMU, or sandbox boundaries.

C:HConfidentiality impact, high

On worker failure f54->report_size retains the prior successful payload size, so memcpy() can write up to roughly twice the newly allocated V4L2 buffer into adjacent vmalloc heap memory, enabling disclosure or corruption of neighboring kernel objects.

I:HIntegrity impact, high

The stale-size memcpy in rmi_f54_buffer_queue() is a controlled kernel heap buffer overflow that can corrupt adjacent vmalloc objects and be developed into arbitrary memory write or code-execution primitives, not merely a bounded data change.

A:HAvailability impact, high

Writing far beyond the shrunken V4L2 capture buffer can corrupt critical kernel heap metadata or adjacent structures, causing kernel oops or panic on affected laptops, kiosks, and embedded touch systems even without full exploit development.