CVE-2026-80570

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: synaptics-rmi4 - zero report size on F54 work error<br /> <br /> In rmi_f54_work(), if an error occurs during report request or command<br /> verification, the code jumped directly to the &amp;#39;error&amp;#39; label, bypassing<br /> the &amp;#39;abort&amp;#39; label where f54-&gt;report_size was normally zeroed out.<br /> <br /> This left f54-&gt;report_size containing its previous successful payload<br /> size. If a user then altered the V4L2 format to a smaller size, and a<br /> subsequent run failed, rmi_f54_buffer_queue() would copy the stale,<br /> larger payload size into the shrunken V4L2 buffer, causing a heap<br /> buffer overflow.<br /> <br /> Fix this by merging the &amp;#39;abort&amp;#39; and &amp;#39;error&amp;#39; labels into a single &amp;#39;out&amp;#39;<br /> exit path, and ensuring that f54-&gt;report_size is always set to 0 on<br /> failure by checking for error and zeroing the local report_size first.