In the Linux kernel’s Synaptics RMI4 touchscreen driver, a bug allows a stale report size to be used after a failed report request or command verification. The old size can be larger than a later V4L2 format requested by the user. When the next operation fails, the driver copies this incorrect size into a smaller user‑visible buffer, triggering a heap buffer overflow that corrupts kernel memory. The flaw is a classic heap‑based overflow and can be exploited by local code executed on the system to execute arbitrary code in kernel space, leading to privilege escalation or denial of service.

Any Linux kernel that contains the synaptics-rmi4 driver prior to the patch that merges the abort and error paths and ensures the report size is zeroed on failure. Versions are not enumerated in the advisory; therefore all distributions and custom kernel builds shipping with this driver before the fix are potentially affected.

The CVSS score is 7.8, indicating a high‑severity memory corruption vector. The EPSS score of <1% indicates a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog, suggesting no publicly known active exploitation at the time of the advisory. The vulnerability requires local interaction with the touchscreen device and a V4L2 format change to trigger the bug, which limits the attack surface. Nonetheless, a heap overflow in kernel space is a high‑severity memory corruption vector. The attack vector is inferred to be local code that can manipulate V4L2 format changes, and the risk remains significant should an attacker gain local execution privileges or if an application performing V4L2 operations can be compromised.