Executive brief
The Linux kernel's iforce joystick/wheel input driver processes USB packets without validating their length, causing it to read beyond packet boundaries. An attacker with control over a malicious iforce-compatible USB device could trigger out-of-bounds memory reads, potentially exposing kernel memory or causing a system crash.
Technical details
The iforce_process_packet() function in the input subsystem reads fixed-size fields from joystick, wheel, and status packets without first validating packet length. Specifically, the shared hats-and-buttons handler unconditionally reads data[6] regardless of actual packet size, the status handler assumes at least 2 bytes, and incomplete 16-bit effect addresses are consumed from truncated packets. Additionally, zero-length USB transfers are processed, reading the packet ID before validation. The fix adds length checks before field access (requiring 7 bytes for joystick/wheel packets, 2 bytes for status packets), rejects zero-length transfers, and ensures only complete 16-bit values are read from the status tail. Attack requires a specially crafted USB device; no network or authentication is needed.
Affected products
- Linux Linux kernel multiple versions (fix backported across 2.6.11–7.2 stable branches)
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched: Fix committed upstream on 2026-07-24, backported to stable branches by 2026-08-23