Cloudanix VulnDB

CVE-2026-80772

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles input from Nintendo game controllers can let an attacker read a small amount of internal operating system memory.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in joycon_ctlr_read_handler() due to insufficient length validation (12-byte check) before casting to 49-byte struct joycon_input_report, allowing up to 37 bytes of kernel memory to be interpreted as IMU data and forwarded to userspace via the input subsystem when a spoofed IMU report is received.

Why it matters to the business

Attackers with physical or emulated controller access can leak small amounts of kernel memory contents, potentially exposing sensitive internal state on Linux systems that support Nintendo Joy-Con or Pro Controllers.

How an attack unfolds

An attacker uses a malicious or emulated Joy-Con/Pro Controller to send a 12-byte HID report with data[0] set to JC_INPUT_IMU_DATA; the handler passes the weak size check, joycon_parse_imu_report() walks the under-sized buffer, and the decoded accelerometer/gyroscope values containing kernel memory are delivered to userspace through the IMU input device.

How to fix it

Apply the upstream kernel patch that replaces the 12-byte guard with a check against sizeof(struct joycon_input_report) before the cast, matching the bounds already used in joycon_ctlr_handle_event(). Rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Inspect the joycon_ctlr_read_handler() function in drivers/hid/hid-nintendo.c to confirm the length check uses sizeof(struct joycon_input_report) and rejects reports smaller than the full structure size before parsing IMU data.

Typical attack path

  1. Obtain or emulate a Nintendo Joy-Con/Pro Controller capable of sending arbitrary HID reports
  2. Transmit a 12-byte report with report type JC_INPUT_IMU_DATA
  3. Trigger joycon_ctlr_read_handler() path that performs the unsafe cast
  4. Receive leaked kernel memory bytes via the IMU input device in userspace

How to detect it

Examine dmesg, input event logs, and HID report traces for unexpected IMU report processing or anomalous data lengths originating from nintendo HID devices; correlate with userspace processes consuming IMU events shortly after controller connection.

What your security team should do

  • Prioritize kernel update on any system exposing Nintendo controller support
  • Restrict physical USB/Bluetooth controller attachment via policy where feasible
  • Monitor kernel changelogs for backported fixes in distribution packages

The record

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cast only with a 12-byte length check: if (size >= 12) /* make sure it contains the input report */ joycon_parse_report(ctlr, (struct joycon_input_report *)data); struct joycon_input_report is 49 bytes: a 13-byte header followed by a union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report() -> joycon_parse_imu_report() walks that union (struct offsets 13..48), so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes the guard yet is read up to 37 bytes past its declared length. The over-read bytes are decoded into accelerometer/gyroscope values and forwarded to userspace through the "(IMU)" input device, leaking driver-internal memory. data[0] and size are fully controlled by a malicious or spoofed Joy-Con/Pro Controller. Receive buffers are sized to the maximum report length, so this is an over-read within the allocation rather than a slab OOB, but the decoded bytes still reach userspace. The sibling subcmd path in joycon_ctlr_handle_event() already bounds the same cast correctly: if (size < sizeof(struct joycon_input_report) || data[0] != JC_INPUT_SUBCMD_REPLY) break; Use the same sizeof(struct joycon_input_report) bound here.

Affected packages

Ecosystem Package Introduced Fixed