The Linux kernel synaptics‑rmi4 driver contains a buffer overflow that occurs when a connected RMI4 device reports more electrodes in its F55 function than it actually has in its F54 function. The driver allocates a data buffer based on the F54 electrode count but calculates the amount of data to read using the potentially larger F55 count. If the counts differ, the read loop writes beyond the end of the allocated buffer, corrupting kernel memory. Attackers who can supply a malicious or misbehaving touchpad interface that advertises an inflated electrode count can trigger this overflow and potentially execute arbitrary code with kernel privileges, leading to full host compromise.

Any Linux kernel that includes the synaptics‑rmi4 driver is subject to this flaw, regardless of distribution. The driver is part of the core kernel source, and no specific kernel version range is provided in the advisory, so all kernels lacking the patch that introduced the bounds check are potentially vulnerable. Systems equipped with Synaptics RMI4 touchpads or other devices exposing an RMI4 interface are at risk when the driver is active.

The CVSS score of 7.8 denotes high severity, and the EPSS score of < 1% indicates a very low exploitation probability. Although current data does not indicate widespread exploitation, the vulnerability enables kernel memory corruption, a critical risk. Exploitation requires a malicious or tampered RMI4 device that advertises anomalous electrode counts. An attacker would need physical access to or otherwise control a connected touchpad device. The flaw is not listed in the CISA KEV catalog, but the high severity warrants prompt mitigation.