In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.

A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.

Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.

https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210

https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec

https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d

https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2

https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42

https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c

https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e

https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/rmi4/rmi_f3a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"502ad7caaa1a445b734c827fa256e5311df67e3d","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"3480e24bc4e178aaa009edb25b6ee12df199e210","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"35ed74d32d8260bdfb14a94caf402bf0866bdeec","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"ba57f430328534501962d60d651e385ffd7af9ca","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"850117b637bcb1dcc14be0cf09ac819a8707b42c","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"8db211aed83733073b0814adaeeab61d4521474e","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42","versionType":"git","status":"affected"},{"version":"9e4c596bfd004f447a652205163234dfd4aafa69","lessThan":"57c10915f2c16c90e0d46ad00876bf39ece40fc2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/rmi4/rmi_f3a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]