CVE-2026-64277: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

mediumCVSS 5.5CVE-2026-64277

CSIRTS triage

vendor: Linux product: synaptics-rmi4Other

What: This vulnerability bounds the F3A keymap to the GPIO count.
Who is affected: Deployments using the synaptics-rmi4 input driver.
Urgency: Remediation is important to ensure proper functionality, although no exploitation has been reported.
Action: Apply the patch for CVE-2026-64277.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch synaptics-rmi4

Get an email when a new synaptics-rmi4 advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: medium — CVSS 5.5
Published: 2026-07-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64277

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-642770.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-64277	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-64277: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bo…nvd

Recent advisories for Input

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-6453: The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to …nvd · 2026-08-01
unknownCVE-2026-34495: Improper neutralization of input during web page generation ('cross-site scripting') vulnerabi…nvd · 2026-07-31
mediumCVE-2025-62347: HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unex…nvd · 2026-07-31
unknownCVE-2026-46593: A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improp…nvd · 2026-07-31
unknownCVE-2025-67650: An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scrip…nvd · 2026-07-31
unknownCVE-2025-67649: A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Imprope…nvd · 2026-07-31