Linux Kernel Synaptics RMI4 Buffer Overread Vulnerability

CVE-2026-64276 is a buffer overread vulnerability in the Linux kernel's Synaptics RMI4 input driver affecting the F30 GPIO/LED keymap handling. The vulnerability occurs when the driver allocates a gpioled_key_map array bounded to a maximum of 6 entries, but then iterates through the full gpioled_count value (0-31 from device registers) during attention handling, causing out-of-bounds memory access. This affects any system using Synaptics RMI4 touchpad controllers, particularly enterprise laptops and workstations. The vulnerability could lead to information disclosure or denial of service if an attacker can trigger the attention handler through malicious device input or firmware manipulation.

While CVE-2026-64276 lacks mapped MITRE ATT&CK techniques, Casky's Claude AI-powered analysis would identify this as a classic Memory Access Violation pattern associated with T1203 (Exploitation for Privilege Escalation) and T1499 (Endpoint Denial of Service). Security practitioners using Casky would see findings highlighting improper input validation in kernel drivers, array bounds checking failures, and unsafe memory dereferencing—patterns that precede kernel exploitation attempts. The extended reasoning capability would correlate this kernel-level memory safety issue with post-exploitation persistence techniques, as compromised kernel memory could enable rootkit installation or privilege escalation chains targeting high-value endpoints.