CVE-2026-80573: Input: iforce - validate input packet lengths
In the Linux kernel, the following vulnerability has been resolved:
Input: iforce - validate input packet lengths
iforceprocesspacket() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called.
Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the resolved logic in the Linux kernel for the iforce driver: reject zero-length USB transfers, require the seven-byte joystick packet before calling the common parser, validate packet lengths before unconditionally reading data[6] in the shared hats-and-buttons helper, and ensure status-tail parsing only consumes complete 16-bit effect address entries (including accounting for the two-byte status prefix and wheel prefixes) without reading an incomplete final entry.
Linux kernel iforce input packet length validation = Reject zero-length USB transfers; require seven-byte joystick packets; check packet lengths before accessing data[6] / status-tail effect address tail parsing
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
The issue affects Linux kernel systems using the iforce input path to process joystick, wheel, or status packets. The available data does not identify affected kernel versions or specific device models.
What malformed input conditions are handled by the fix?
The fix rejects zero-length USB transfers, requires at least seven bytes for joystick and wheel packet prefixes, and requires at least two bytes for status packet prefixes. It also processes status-tail effect addresses only when a complete 16-bit address is present.