Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-63943

Input: xpad - fix out-of-bounds access for Share button

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • cbc82e7db16d59c301457312a624a7de2c03cd4a to < bcfb4833cd4078a1a356ef451838b75cd233099eaffected
  • 302a0cd0bbc450998429a3f4267970a4b93251a8 to < 37ec54abfdd63a63fd50734a9c4e4cbc1e5795afaffected
  • 4ef46367073b107ec22f46fe5f12176e87c238e8 to < 9749db57233b396353ad5dee81eec9d9880c9246affected
  • 4ef46367073b107ec22f46fe5f12176e87c238e8 to < 6346b0895b574ce45f3747b9c508c72f70e6abefaffected
  • 4ef46367073b107ec22f46fe5f12176e87c238e8 to < 6cdc46b38cf146ce81d4831b6472dbf7731849a2affected
  • a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8affected
  • 6.6.91 to < 6.6.143affected
  • 6.12.29 to < 6.12.93affected
  • 6.14.7 to < 6.15affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.93 to ≤ 6.12.*unaffected
  • 6.18.35 to ≤ 6.18.*unaffected
  • 7.0.12 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References