Executive brief
A vulnerability in the Linux kernel's PlayStation controller driver could allow a malicious USB or Bluetooth device to trigger an out-of-bounds memory read. By providing a false number of touch reports, a device can cause the system to read beyond its allocated memory buffer, potentially leaking small amounts of kernel data or causing system instability. This requires a malicious device to be physically connected or paired via Bluetooth to the affected system.
Technical details
An out-of-bounds read vulnerability exists in 'drivers/hid/hid-playstation.c' within the 'dualshock4_parse_report' function. The driver fails to validate the 'num_touch_reports' value provided by the HID device against the actual size of the 'touch_reports' array. An attacker with physical access or the ability to pair a malicious Bluetooth device can provide a 'num_touch_reports' value up to 255, causing the loop to read approximately 2 KiB past the end of the buffer. This out-of-bounds data may be leaked to userspace via the evdev interface if specific bits (DS4_TOUCH_POINT_INACTIVE) are set in the out-of-bounds memory. The fix involves clamping the 'num_touch_reports' value using 'min_t' against the 'ARRAY_SIZE' of the destination buffer.
Affected products
- Linux Foundation Linux kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-17: other: Patch authored
- 2026-05-17: patched: Patch committed to stable tree
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4
- https://git.kernel.org/stable/c/208f6d5b1dfd6399bc6af9e11f27f1f496243ed0
- https://git.kernel.org/stable/c/7812694752a5f295eaa05a093b90a2c332666051
- https://git.kernel.org/stable/c/9c031b24aed6733b6dcc5d98527875b8654a04e9
- https://git.kernel.org/stable/c/cac61b58a3b6340c52afa06bb15eac033158db2f