CVE-2026-64277 (GCVE-0-2026-64277)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 502ad7caaa1a445b734c827fa256e5311df67e3d (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 3480e24bc4e178aaa009edb25b6ee12df199e210 (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 35ed74d32d8260bdfb14a94caf402bf0866bdeec (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < ba57f430328534501962d60d651e385ffd7af9ca (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 850117b637bcb1dcc14be0cf09ac819a8707b42c (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 8db211aed83733073b0814adaeeab61d4521474e (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42 (git)
Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 57c10915f2c16c90e0d46ad00876bf39ece40fc2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f3a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "502ad7caaa1a445b734c827fa256e5311df67e3d",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "3480e24bc4e178aaa009edb25b6ee12df199e210",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "35ed74d32d8260bdfb14a94caf402bf0866bdeec",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "ba57f430328534501962d60d651e385ffd7af9ca",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "850117b637bcb1dcc14be0cf09ac819a8707b42c",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "8db211aed83733073b0814adaeeab61d4521474e",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "57c10915f2c16c90e0d46ad00876bf39ece40fc2",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f3a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a-\u003egpio_count = buf \u0026 RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input-\u003ekeycodemax is set to the full gpio_count\nwhile input-\u003ekeycode points at the 6-entry allocation.\n\nA device that reports gpio_count \u003e 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core\u0027s default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The highest-severity defensible path is local: a process that can open the affected RMI touchpad\u0027s evdev node can invoke the vulnerable keymap ioctls. A malicious USB RMI device is also a physical trigger, but the local ioctl path is more severe.\nAC:L - On a vulnerable device reporting more than six GPIOs, selecting any keymap index from 6 through gpio_count-1 deterministically accesses beyond the allocation. No race or condition outside the attacker\u0027s control is required.\nPR:L - The evdev keymap ioctl path has no capability or authentication check; only ordinary device-node access controls apply. An unprivileged user with seat, ACL, or input-device access can exploit it without administrative capabilities.\nUI:N - The attacker directly issues EVIOCGKEYCODE or EVIOCSKEYCODE after opening the node. No action by another user is required.\nS:U - Exploitation compromises the host kernel within the same security authority. It does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - EVIOCGKEYCODE can disclose successive 16-bit words across as much as 242 bytes beyond the six-entry keymap, exposing adjacent slab contents and potentially kernel pointers. The accompanying corruption can also support stronger disclosure primitives.\nI:H - EVIOCSKEYCODE provides indexed, caller-controlled 16-bit writes throughout the out-of-bounds range. This heap corruption can overwrite adjacent pointers or control data and plausibly enable kernel code execution.\nA:H - The controlled heap overwrite can corrupt adjacent slab objects and cause a kernel oops or panic, while device attention interrupts repeatedly exercise the out-of-bounds read. The failure can be triggered repeatedly without victim interaction."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:32.147Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"
        },
        {
          "url": "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"
        },
        {
          "url": "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"
        },
        {
          "url": "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"
        }
      ],
      "title": "Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64277",
    "datePublished": "2026-07-25T08:49:21.936Z",
    "dateReserved": "2026-07-19T15:36:31.776Z",
    "dateUpdated": "2026-08-17T04:52:32.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64277",
      "date": "2026-09-21",
      "epss": "0.00169",
      "percentile": "0.06594"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:48:45.000Z",
      "cve": "CVE-2026-64277",
      "id": "msrc_CVE-2026-64277",
      "initial_release_date": "2026-07-26T01:06:52.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64277.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/input/rmi4/rmi_f3a.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "502ad7caaa1a445b734c827fa256e5311df67e3d",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3480e24bc4e178aaa009edb25b6ee12df199e210",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35ed74d32d8260bdfb14a94caf402bf0866bdeec",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba57f430328534501962d60d651e385ffd7af9ca",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "850117b637bcb1dcc14be0cf09ac819a8707b42c",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8db211aed83733073b0814adaeeab61d4521474e",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57c10915f2c16c90e0d46ad00876bf39ece40fc2",
                    "status": "affected",
                    "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/input/rmi4/rmi_f3a.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "696CCB54-4E61-4603-AE9B-F4A19836CA65",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a-\u003egpio_count = buf \u0026 RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input-\u003ekeycodemax is set to the full gpio_count\nwhile input-\u003ekeycode points at the 6-entry allocation.\n\nA device that reports gpio_count \u003e 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core\u0027s default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting."
          }
        ],
        "id": "CVE-2026-64277",
        "lastModified": "2026-08-17T05:17:26.897",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:08.197",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-07T19:38:10+00:00",
      "cve": "CVE-2026-64277",
      "id": "CVE-2026-64277",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64277.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:42:12Z",
      "cve": "CVE-2026-64277",
      "id": "CVE-2026-64277",
      "initial_release_date": "2026-07-25T16:46:45Z",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "205",
      "product_status:recommended": "214",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64277",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64277.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.