Input Validation Flaw in Linux Kernel Affecting Joystick and Wheel Processing

CVE-2026-80573

What is CVE-2026-80573?

The vulnerability in the Linux kernel relates to an input validation issue where the function iforce_process_packet() reads fixed fields from joystick, wheel, and status packets without validating their lengths beforehand. This oversight allows for potential consumption of incomplete data, especially in cases involving incomplete status tail addresses and zero-length USB URBs. A successful exploitation could lead to system instability or erroneous behavior due to malformed packets. The resolution includes rejecting zero-length USB transfers, enforcing the necessary fixed-length prefixes, and only processing complete addresses in the status tail.

References