Junglewise Threat Intelligence

CVE-2026-64273: Linux Kernel out-of-bounds write in iforce joystick driver

CVE-2026-64273 · Severity: info · CVSS 6.8 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability was identified in the Linux kernel's 'iforce' driver, which manages certain joysticks and game controllers with force-feedback features. A malicious or counterfeit hardware device plugged into the system could trigger a memory error, potentially allowing the device to crash the system or gain unauthorized access to kernel memory. This issue primarily affects systems where untrusted USB or serial input devices can be physically connected.

Technical details

An out-of-bounds (OOB) write vulnerability exists in the iforce driver (drivers/input/joystick/iforce/iforce-packets.c) within the iforce_process_packet() function. The driver fails to properly validate the force-feedback effect index received from the device wire; while the index is masked to 7 bits (0-127), the destination array 'core_effects' is limited to IFORCE_EFFECTS_MAX (32) entries. An attacker with physical access can use a malicious USB or serio device to provide an index between 32 and 127, triggering a single-bit read-modify-write via test_and_set_bit() or test_and_clear_bit() outside the intended structure. This can lead to kernel memory corruption or local privilege escalation. The issue has been resolved by adding explicit bounds checking against IFORCE_EFFECTS_MAX.

Affected products

  • Linux Linux Kernel 1da177e4c3f4 to 0e9943d2e4c6

Timeline

  • 2026-06-22: disclosed: Vulnerability reported and patch authored
  • 2026-07-24: patched: Patch committed to stable branches
  • 2026-07-25: advisory: CVE-2026-64273 published

References

Related threats