CVE-2026-46232: HID: playstation: Clamp num_touch_reports
In dualshock4parsereport of hid-playstation.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
HID: playstation: Clamp numtouchreports
A device would never lie about the number of touch reports would it?
If it does the loop in dualshock4parsereport will read off the end of the touchreports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4TOUCHPOINTINACTIVE bit happens to be set. Protect against this by clamping the numtouchreports value provided by the device to the maximum size of the touchreports array.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.140 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.90 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.32 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2026-11-05
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46232?
The severity of CVE-2026-46232 is rated as high with a score of 8.1.
How do I fix CVE-2026-46232?
To fix CVE-2026-46232, you should update to the latest version of the Linux kernel that resolves this vulnerability.
What are the potential impacts of CVE-2026-46232?
CVE-2026-46232 could allow an attacker to cause a denial of service by reading beyond the end of the touch_reports array.
Which software is affected by CVE-2026-46232?
CVE-2026-46232 affects the Linux kernel specifically within the hid-playstation component.
When was CVE-2026-46232 published?
CVE-2026-46232 was published on May 28, 2026.