An out-of-bounds memory access vulnerability exists in the Linux kernel synaptics-rmi4 input driver, which can lead to privilege escalation or system instability.

This is an out-of-bounds read and write flaw within the synaptics-rmi4 input driver handler, triggered when processing device GPIO and LED counts via keymap allocation functions with low privileges required and no user interaction.

Successful exploitation of this flaw can allow a local attacker with low privileges to achieve high system impacts, potentially compromising system confidentiality, integrity, and availability. With a CVSS score of 7.8, the vulnerability poses a significant risk to multi-tenant environments or systems where untrusted local users have shell access, as it can lead to arbitrary code execution or kernel panics.

Immediate Action: Update the Linux kernel to patched versions such as 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later depending on the active release series.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual driver errors associated with input subsystems.

Compensating Controls: Restrict local shell access and auditing user accounts to limit the exposure of local attack vectors.

Public Exploit Available: false

Administrators managing systems utilizing the affected Linux kernel versions should prioritize deploying the latest kernel updates provided by their distribution maintainers. Applying these patches promptly is crucial to eliminate the risk of local privilege escalation and maintain overall system security.