CVE-2026-63943

Summary

In the Linux kernel, the following vulnerability has been resolved:

Input: xpad - fix out-of-bounds access for Share button

xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array.

Fix this by calculating the offset and checking bounds against the packet length.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxcbc82e7db16d59c301457312a624a7de2c03cd4a < bcfb4833cd4078a1a356ef451838b75cd233099eaffected
LinuxLinux302a0cd0bbc450998429a3f4267970a4b93251a8 < 37ec54abfdd63a63fd50734a9c4e4cbc1e5795afaffected
LinuxLinux4ef46367073b107ec22f46fe5f12176e87c238e8 < 9749db57233b396353ad5dee81eec9d9880c9246affected
LinuxLinux4ef46367073b107ec22f46fe5f12176e87c238e8 < 6346b0895b574ce45f3747b9c508c72f70e6abefaffected
LinuxLinux4ef46367073b107ec22f46fe5f12176e87c238e8 < 6cdc46b38cf146ce81d4831b6472dbf7731849a2affected
LinuxLinuxa7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8affected
LinuxLinux6.6.91 < 6.6.143affected
LinuxLinux6.12.29 < 6.12.93affected
LinuxLinux6.14.7 < 6.15affected
LinuxLinux6.15affected
LinuxLinux0 < 6.15unaffected
LinuxLinux6.6.143 <= 6.6.*unaffected
LinuxLinux6.12.93 <= 6.12.*unaffected
LinuxLinux6.18.35 <= 6.18.*unaffected
LinuxLinux7.0.12 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References