The flaw in the synaptics-rmi4 driver allows an attacker to trigger a heap buffer overflow by changing the input (diagnostic report type) while the V4L2 device is actively streaming. The new report size can be larger than the buffers allocated at stream start. If the input change is not blocked, the driver will write beyond the allocated buffer boundaries, leading to corruption of adjacent heap objects. This can be leveraged to execute arbitrary code or crash the system, thereby compromising confidentiality, integrity, or availability of the affected host. The weakness is an instance of improper input size handling (CWE-119), heap-based buffer overflow (CWE-120), and array index out-of-bounds (CWE-131).

All Linux kernel installations that include the synaptics-rmi4 driver are affected. No specific kernel version ranges are listed, so the vulnerability may exist in any kernel build that has shipped the unpatched code. The problem is inherent to the Linux kernel rather than a vendor’s proprietary product.

The CVSS score for this issue is 7.8, and the EPSS score is less than 1%, making the exploitation probability difficult to quantify. The vulnerability is not present in CISA’s Known Exploited Vulnerabilities catalog, suggesting no publicly known exploitation. However, the nature of the buffer overflow and the lack of a blocking mechanism means the risk is technically high if an attacker can control the input stream mid‑capture. The likely attack vector is local privilege escalation or a compromised device driver scenario, where the attacker can issue V4L2 requests that change the input during an active stream.