During F55 sensor detection the synaptics-rmi4 driver mistakenly copies the receiver electrode count into the transmitter field. The inflated transmitter value is used to size a diagnostics buffer, which can become larger than the allocated space. When the driver writes into this buffer it performs an out‑of-bounds write, corrupting kernel memory and potentially enabling a local privilege escalation or a denial‑of‑service through a kernel crash.

All Linux kernel builds that include the synaptics-rmi4 driver before the published fix commit are affected. The problem exists in every kernel revision that ships with the unpatched driver code, regardless of architecture or distribution.

No CVSS or EPSS score was published and the vulnerability is not listed in the CISA KEV catalog. The nature of the flaw—a kernel buffer overflow that corrupts memory—implies a high severity. Exploitation would require local access to the system or the ability to provoke the sensor detection routine, making remote exploitation unlikely unless additional privileges or device access are available.