Executive brief
The Linux kernel's Nintendo Joy-Con controller driver contains a memory read vulnerability in the HID input report handler. A malicious or spoofed Joy-Con or Pro Controller can send specially crafted reports that cause the driver to read beyond the declared buffer size, leaking internal kernel memory to userspace through IMU (accelerometer/gyroscope) sensor data. This could expose sensitive information from system memory.
Technical details
The joycon_ctlr_read_handler() function in drivers/hid/hid-nintendo.c casts incoming HID input reports to a 49-byte struct joycon_input_report but only validates that the report is at least 12 bytes. For IMU reports, joycon_parse_imu_report() accesses the union members at offsets 13–48, causing reads up to 37 bytes beyond a 12-byte report's declared length. The receive buffer is allocated to maximum report size, so the over-read stays within the allocation, but the leaked bytes are decoded as sensor values and forwarded to userspace via the input device interface. The attack vector is fully controlled by the HID device itself (data[0] and size fields). The fix changes the length guard from `size >= 12` to `size >= sizeof(struct joycon_input_report)` (49 bytes), matching the validation already used in the sibling subcmd path.
Affected products
- Linux Linux kernel Various versions from before 2026-07-15 (patched in commit 27b376b945c0aac46fcdfcc950b14a85b874b557)
Timeline
- 2026-09-04: disclosed: Published in NVD