During F55 sensor detection the synaptics-rmi4 driver mistakenly copies the receiver electrode count into the transmitter field. This misassignment is a classic buffer overflow (CWE-120). The inflated transmitter value is used to size a diagnostics buffer, which can become larger than the allocated space. When the driver writes into this buffer it performs an out-of-bounds write, corrupting kernel memory and potentially enabling a local privilege escalation or a denial-of-service through a kernel crash.

All Linux kernel builds that include the synaptics-rmi4 driver before the published fix commit are affected. The problem exists in every kernel revision that ships with the unpatched driver code, regardless of architecture or distribution.

The CVSS score is 7.8 and the EPSS score is <1%. The vulnerability is not listed in the CISA KEV catalog. The nature of the flaw—a kernel buffer overflow that corrupts memory—implies a high severity. Exploitation would require local access to the system or the ability to provoke the sensor detection routine, making remote exploitation unlikely unless additional privileges or device access are available.