https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 23:45:04 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80570 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Input: synaptics-rmi4 - zero report size on F54 work error</p> <p>In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the &#39;error&#39; label, bypassing the &#39;abort&#39; label where f54-&gt;report_size was normally zeroed out.</p> <p>This left f54-&gt;report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow.</p> <p>Fix this by merging the &#39;abort&#39; and &#39;error&#39; labels into a single &#39;out&#39; exit path, and ensuring that f54-&gt;report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Input: synaptics-rmi4 - zero report size on F54 work error</p> <p>In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the &#39;error&#39; label, bypassing the &#39;abort&#39; label where f54-&gt;report_size was normally zeroed out.</p> <p>This left f54-&gt;report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow.</p> <p>Fix this by merging the &#39;abort&#39; and &#39;error&#39; labels into a single &#39;out&#39; exit path, and ensuring that f54-&gt;report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.</p> https://vulnerability.circl.lu/vuln/cve-2026-80570