{"apiVersion":"1.0","identifier":"CVE-2026-80570","description":"In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the -error- label, bypassing the -abort- label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow. Fix this by merging the -abort- and -error- labels into a single -out- exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.","publishedAt":"2026-08-26T15:17:12","lastModifiedAt":"2026-08-27T06:17:42","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80570","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00134,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-80570","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-80570","en":"https://www.redsauce.net/en/cves/CVE-2026-80570","fr":"https://www.redsauce.net/fr/cves/CVE-2026-80570","pt":"https://www.redsauce.net/pt/cves/CVE-2026-80570","de":"https://www.redsauce.net/de/cves/CVE-2026-80570","sk":"https://www.redsauce.net/sk/cves/CVE-2026-80570","el":"https://www.redsauce.net/el/cves/CVE-2026-80570"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-80570"}}