CVE-2026-63943 (GCVE-0-2026-63943)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length.
References
Impacted products
Vendor Product Version
Linux Linux Version: cbc82e7db16d59c301457312a624a7de2c03cd4a
Version: 302a0cd0bbc450998429a3f4267970a4b93251a8
Version: 4ef46367073b107ec22f46fe5f12176e87c238e8
Version: 4ef46367073b107ec22f46fe5f12176e87c238e8
Version: 4ef46367073b107ec22f46fe5f12176e87c238e8
Version: a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8
Version: 6.6.91   ≤
Version: 6.12.29   ≤
Version: 6.14.7   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/joystick/xpad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bcfb4833cd4078a1a356ef451838b75cd233099e",
              "status": "affected",
              "version": "cbc82e7db16d59c301457312a624a7de2c03cd4a",
              "versionType": "git"
            },
            {
              "lessThan": "37ec54abfdd63a63fd50734a9c4e4cbc1e5795af",
              "status": "affected",
              "version": "302a0cd0bbc450998429a3f4267970a4b93251a8",
              "versionType": "git"
            },
            {
              "lessThan": "9749db57233b396353ad5dee81eec9d9880c9246",
              "status": "affected",
              "version": "4ef46367073b107ec22f46fe5f12176e87c238e8",
              "versionType": "git"
            },
            {
              "lessThan": "6346b0895b574ce45f3747b9c508c72f70e6abef",
              "status": "affected",
              "version": "4ef46367073b107ec22f46fe5f12176e87c238e8",
              "versionType": "git"
            },
            {
              "lessThan": "6cdc46b38cf146ce81d4831b6472dbf7731849a2",
              "status": "affected",
              "version": "4ef46367073b107ec22f46fe5f12176e87c238e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.93",
              "status": "affected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/joystick/xpad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.12.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: xpad - fix out-of-bounds access for Share button\n\nxpadone_process_packet() receives len directly from urb-\u003eactual_length\nand uses it to index the share-button byte at data[len - 18] or\ndata[len - 26]. Since both len and data[0] are under the device\u0027s\ncontrol, a broken controller can send a GIP_CMD_INPUT packet with\nactual_length \u003c 18 (e.g. 5 bytes) and reach this code path, causing\naccesses beyond the actual array.\n\nFix this by calculating the offset and checking bounds against the\npacket length."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:38.411Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e"
        },
        {
          "url": "https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af"
        },
        {
          "url": "https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246"
        },
        {
          "url": "https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2"
        }
      ],
      "title": "Input: xpad - fix out-of-bounds access for Share button",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63943",
    "datePublished": "2026-07-19T14:55:38.411Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-07-19T14:55:38.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.