Cloudanix VulnDB

CVE-2026-63943

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the way Linux talks to some gamepads could let a bad controller make the computer crash or leak internal data.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Out-of-bounds read in xpadone_process_packet when urb->actual_length is smaller than required offsets for Share button data, allowing device-controlled short packets to index past the received buffer.

Why it matters to the business

Kernel instability, crashes, or information disclosure on Linux systems using Xbox controllers, raising support costs and availability risks for gaming, desktop, or embedded deployments.

How an attack unfolds

An attacker supplies a malicious or faulty controller that emits a short GIP_CMD_INPUT packet; the driver blindly indexes data[len-18] or data[len-26] without validating length, triggering the out-of-bounds access.

How to fix it

Apply the upstream kernel patch that calculates the Share-button offset and validates it against packet length before access; rebuild and deploy the updated kernel image.

How to confirm the fix worked

Confirm the bounds-check logic is present in xpadone_process_packet and test with deliberately short controller packets to ensure no crash occurs.

Typical attack path

  1. Connect modified controller to USB port
  2. Controller emits GIP_CMD_INPUT packet with actual_length < 18
  3. xpad driver receives packet and calls xpadone_process_packet
  4. Driver computes offset from uncontrolled len and reads beyond buffer
  5. Resulting oob read causes crash or leaks adjacent kernel memory

How to detect it

Review kernel logs for xpad or input subsystem faults, oops messages, or USB URB length anomalies around controller attach events.

What your security team should do

  • Patch kernels on all systems exposing the xpad driver
  • Restrict physical USB access where feasible until patched
  • Monitor vendor advisories for backported fixes in distribution kernels

The record

In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities