A flaw in the Linux kernel synaptics-rmi4 driver allows a malicious or malfunctioning RMI4 device that reports larger F55 electrode counts than its F54 counts to cause a heap buffer overflow when reading diagnostic data. The driver allocates a fixed‑size buffer based on the F54 electrode count but trusts the F55 electrode count to calculate the size of the data it will read. When the device reports an F55 count larger than the allocated buffer, the read loop writes beyond the buffer boundaries, leading to kernel memory corruption that can be exploited to execute arbitrary code with kernel privileges, potentially allowing complete host compromise. The threat that an attacker can control such a device is inferred from the mention of a malicious or malfunctioning device but is not explicitly stated in the advisory.

The vulnerability is present in any Linux kernel that includes the synaptics‑rmi4 driver in its build, regardless of distribution, as the affected code is part of the core kernel source. No specific kernel version range is provided in the advisory, so all kernels that have not yet received the state‑of‑the‑art patch are potentially affected. Systems that use Synaptics touchpads or other devices that expose an RMI4 interface are at risk whenever the driver is active.

The CVSS or EPSS scores are not supplied in the advisory. However, because the flaw writes into kernel memory, the potential impact is high. The advisory implies that exploitation requires a malicious RMI4 device that reports anomalous electrode counts. It is inferred that an attacker would need to supply or spoof such a device, which may require physical access or compromised firmware on a connected touchscreen. There is no indication that the flaw is currently demonstrated in the wild, and it is not listed in the CISA KEV catalog. Nonetheless, the high severity of a kernel memory corruption warrants prompt action.