CyberSecBulletin
CVE-2026-64277NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64277 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 502ad7caaa1a445b734c827fa256e5311df67e3d, 3480e24bc4e178aaa009edb25b6ee12df199e210, 35ed74d32d8260bdfb14a94caf402bf0866bdeec as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 502ad7caaa1a445b734c827fa256e5311df67e3d or 3480e24bc4e178aaa009edb25b6ee12df199e210 or 35ed74d32d8260bdfb14a94caf402bf0866bdeec or ba57f430328534501962d60d651e385ffd7af9ca, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 502ad7caaa1a445b734c827fa256e5311df67e3d; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 3480e24bc4e178aaa009edb25b6ee12df199e210; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 35ed74d32d8260bdfb14a94caf402bf0866bdeec; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, ba57f430328534501962d60d651e385ffd7af9ca; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 850117b637bcb1dcc14be0cf09ac819a8707b42c; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 8db211aed83733073b0814adaeeab61d4521474e; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42; 9e4c596bfd004f447a652205163234dfd4aafa69 up to, but not including, 57c10915f2c16c90e0d46ad00876bf39ece40fc2; and 1 more ranges502ad7caaa1a445b734c827fa256e5311df67e3d, 3480e24bc4e178aaa009edb25b6ee12df199e210, 35ed74d32d8260bdfb14a94caf402bf0866bdeec, ba57f430328534501962d60d651e385ffd7af9ca, 850117b637bcb1dcc14be0cf09ac819a8707b42c, 8db211aed83733073b0814adaeeab61d4521474e
LinuxLinux Kernel5.10 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.45.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.