In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and inpu
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64277 is a memory safety vulnerability in the Linux kernel's Synaptics RMI4 input device driver. The vulnerability exists in the F3A (Force3A) GPIO handling code, where a mismatch between allocated buffer size and iteration bounds causes potential out-of-bounds memory access. The driver queries a device register to obtain GPIO count (0-127 range), allocates a keymap array limited to 6 entries, but then iterates through the full GPIO count when processing input events. This affects systems using Synaptics touchpad devices with RMI4 firmware, particularly laptops and embedded systems relying on this input subsystem. The CVSS 7.8 (high) rating reflects the potential for denial of service or information disclosure through controlled kernel memory access.
Casky's platform would detect this vulnerability pattern through code analysis capabilities focused on memory safety anti-patterns and resource management mismatches. Practitioners using Casky would identify findings related to insufficient bounds checking on array operations, size mismatches between allocation and usage, and inadequate input validation on device-controlled values. While MITRE ATT&CK mappings weren't available for this CVE, the underlying attack pattern aligns with Improper Input Validation (CWE-20) exploitation scenarios. Security teams leveraging Casky's 754 skill mappings would flag this as a critical kernel hardening gap, emphasizing the need for kernel patching, input device driver auditing, and defensive coding practices that enforce consistent bounds checking between buffer allocation and iteration operations.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64277. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation