A flaw in the Synaptics RMI4 input driver causes the kernel to allocate a GPIO/LED key map with a maximum of six entries while the device may report up to 32 entries. When the driver receives an attention interrupt or when applications use the EVIOCGKEYCODE or EVIOCSKEYCODE ioctl, it iterates over the full reported count and reads or writes beyond the bounds of the allocated buffer. This out‑of‑bounds memory access can expose kernel memory contents or overwrite critical kernel data, potentially enabling privileged code to read sensitive information or gain higher privileges.

All Linux kernel installations that load the Synaptics RMI4 driver with GPIO/LED support enabled and that are connected to a device reporting more than six GPIO/LED entries are affected. No specific kernel release information is supplied, so the vulnerability could exist in any kernel version that contains the unpatched driver code. The only vendor/product noted is Linux:Linux, indicating that the defect resides in the general Linux kernel.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of current exploitation. Nonetheless, the flaw permits low‑level kernel memory corruption, which is a high‑risk condition. An attacker with local or privileged access could trigger the attention interrupt or invoke the ioctl interfaces if the device is present, and thereby mount a privilege‑escalation or denial‑of‑service attack. The attack vector is likely local, depending on the ability to influence the device’s gpioled_count configuration.