The synaptics‑rmi4 input driver allocates a keymap array sized to the GPIO count reported by a touchpad device, but later accesses the array out of bounds. This out‑of‑bounds read leaks neighboring slab memory through the EVIOCGKEYCODE ioctl, and a complementary write past the end of the array is possible via EVIOCSKEYCODE for any process that can open the evdev device. The flaw therefore creates a kernel memory disclosure and a local write capability.

All Linux kernel builds that compile the synaptics‑rmi4 input driver are affected when a device reports more than six GPIOs. The vulnerability exists as long as the driver is enabled and the hardware advertises a larger gpio_count, regardless of distribution or kernel configuration.

It is inferred that an attacker would need local access to the evdev node associated with the synaptics‑rmi4 device, which is typically granted to regular users. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low probability of widespread exploitation. The CVSS score of 7.8 reflects moderate‑to‑high severity. The flaw exposes kernel memory through EVIOCGKEYCODE and allows writes past the keymap via EVIOCSKEYCODE, giving a local write capability. This local write capability could enable privilege escalation, but that consequence is inferred from the potential impact rather than directly stated in the description.