CVE-2026-80567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80567", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.768Z", "datePublished": "2026-08-26T14:37:30.152Z", "dateUpdated": "2026-08-26T14:37:30.152Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-26T14:37:30.152Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue\n\nPreviously, rmi_f54_buffer_queue() waited for the worker thread to\nfinish but ignored whether it succeeded. If the worker failed (e.g.,\ndue to a timeout or register read failure), the queue thread would\nsilently return success, delivering stale or uninitialized memory to\nuserspace.\n\nAdd a 'report_error' field to struct f54_data to store the worker's exit\nstatus. Check this field in rmi_f54_buffer_queue() after the worker\nfinishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error\noccurred."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "versions": [{"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "305c24ee25b6e08ac9f4c5f697e823cc638c38da", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "7d33b752e0df385b285492b74699fc73b6becdfb", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "be56730b547737151f24357d832b04aaa93755d5", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "2b0403fb7e28f65883cd03814b62c9aa9bc7f04d", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "6741a8c21d98088b7f2d9f4f86a706d311ce34a2", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "70f9aad3943559af6f32cb303744f35c05ce9cf1", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "9bbd3682f8a3e064271547133c37fcb17668d860", "status": "affected", "versionType": "git"}, {"version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "lessThan": "8786d74bf50e6797b6f655eb381ef6b25451161f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/305c24ee25b6e08ac9f4c5f697e823cc638c38da"}, {"url": "https://git.kernel.org/stable/c/7d33b752e0df385b285492b74699fc73b6becdfb"}, {"url": "https://git.kernel.org/stable/c/be56730b547737151f24357d832b04aaa93755d5"}, {"url": "https://git.kernel.org/stable/c/2b0403fb7e28f65883cd03814b62c9aa9bc7f04d"}, {"url": "https://git.kernel.org/stable/c/6741a8c21d98088b7f2d9f4f86a706d311ce34a2"}, {"url": "https://git.kernel.org/stable/c/70f9aad3943559af6f32cb303744f35c05ce9cf1"}, {"url": "https://git.kernel.org/stable/c/9bbd3682f8a3e064271547133c37fcb17668d860"}, {"url": "https://git.kernel.org/stable/c/8786d74bf50e6797b6f655eb381ef6b25451161f"}], "title": "Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "305c24ee25b6e08ac9f4c5f697e823cc638c38da", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "7d33b752e0df385b285492b74699fc73b6becdfb", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "be56730b547737151f24357d832b04aaa93755d5", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "2b0403fb7e28f65883cd03814b62c9aa9bc7f04d", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "6741a8c21d98088b7f2d9f4f86a706d311ce34a2", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "70f9aad3943559af6f32cb303744f35c05ce9cf1", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "9bbd3682f8a3e064271547133c37fcb17668d860", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}, {"lessThan": "8786d74bf50e6797b6f655eb381ef6b25451161f", "status": "affected", "version": "3a762dbd5347514c3cb2ac756a92a3d1c7646a2d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/input/rmi4/rmi_f54.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue\n\nPreviously, rmi_f54_buffer_queue() waited for the worker thread to\nfinish but ignored whether it succeeded. If the worker failed (e.g.,\ndue to a timeout or register read failure), the queue thread would\nsilently return success, delivering stale or uninitialized memory to\nuserspace.\n\nAdd a 'report_error' field to struct f54_data to store the worker's exit\nstatus. Check this field in rmi_f54_buffer_queue() after the worker\nfinishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error\noccurred."}], "id": "CVE-2026-80567", "lastModified": "2026-08-26T15:17:12.140", "metrics": {}, "published": "2026-08-26T15:17:12.140", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b0403fb7e28f65883cd03814b62c9aa9bc7f04d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/305c24ee25b6e08ac9f4c5f697e823cc638c38da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6741a8c21d98088b7f2d9f4f86a706d311ce34a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70f9aad3943559af6f32cb303744f35c05ce9cf1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d33b752e0df385b285492b74699fc73b6becdfb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8786d74bf50e6797b6f655eb381ef6b25451161f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9bbd3682f8a3e064271547133c37fcb17668d860"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be56730b547737151f24357d832b04aaa93755d5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue", "id": "2524449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524449"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nInput: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue\nPreviously, rmi_f54_buffer_queue() waited for the worker thread to\nfinish but ignored whether it succeeded. If the worker failed (e.g.,\ndue to a timeout or register read failure), the queue thread would\nsilently return success, delivering stale or uninitialized memory to\nuserspace.\nAdd a 'report_error' field to struct f54_data to store the worker's exit\nstatus. Check this field in rmi_f54_buffer_queue() after the worker\nfinishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error\noccurred.", "A flaw was found in the Linux kernel. The `synaptics-rmi4` input driver's `rmi_f54_buffer_queue()` function failed to propagate errors from its worker thread. This oversight could result in the delivery of stale or uninitialized memory to user applications, potentially leading to information disclosure or system instability."], "name": "CVE-2026-80567", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80567\nhttps://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80567-15b0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,305c24ee25b6e08ac9f4c5f697e823cc638c38da)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,7d33b752e0df385b285492b74699fc73b6becdfb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,be56730b547737151f24357d832b04aaa93755d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,2b0403fb7e28f65883cd03814b62c9aa9bc7f04d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,6741a8c21d98088b7f2d9f4f86a706d311ce34a2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,70f9aad3943559af6f32cb303744f35c05ce9cf1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,9bbd3682f8a3e064271547133c37fcb17668d860)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a762dbd5347514c3cb2ac756a92a3d1c7646a2d,8786d74bf50e6797b6f655eb381ef6b25451161f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.266,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.217,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.184,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.153,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.105,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.46,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T17:00:04.694939+00:00", "updated": "2026-08-28T17:45:04.131968+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}