Executive brief
A vulnerability was identified in the Linux kernel's Xbox controller driver (xpad). A malicious or malfunctioning controller connected via USB could send specially crafted data packets that cause the system to access memory outside of the intended range. This could potentially lead to a system crash or other unpredictable behavior when the 'Share' button functionality is processed.
Technical details
An out-of-bounds read vulnerability exists in the xpadone_process_packet() function within drivers/input/joystick/xpad.c. The function uses the 'actual_length' value directly from the USB Request Block (URB) to calculate offsets for the 'Share' button data without adequate bounds checking. An attacker with physical access could connect a malicious USB device that sends a GIP_CMD_INPUT packet with a length shorter than the expected 18 or 26 bytes, leading to an out-of-bounds access. The issue has been resolved by implementing explicit length validation against the calculated offset before accessing the data array.
Affected products
- Linux Linux Kernel 6.6.91 to 6.6.143, 6.12.29 to 6.12.93, 6.14.7 to 6.15
Timeline
- 2026-04-26: patched: Initial fix authored by Dmitry Torokhov
- 2026-07-19: advisory: CVE-2026-63943 published by NVD
References
- https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af
- https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef
- https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2
- https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246
- https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e