Linux Kernel Vulnerability Affecting Playstation HID Devices

CVE-2026-46232

What is CVE-2026-46232?

An input validation error in the Linux kernel's HID subsystem affects DualShock 4 controllers. Specifically, the device may inaccurately report the number of touch reports, which can lead to out-of-bounds reading in the 'dualshock4_parse_report' function. This flaw allows excessive reading attempts from the touch_reports array, potentially exposing unintended data through evdev when specific conditions are met. The vulnerability has been addressed by clamping the reported value to the maximum allowable limit, ensuring that the array remains within bounds.

References