CVE-2026-80772: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In joycon_ctlr_read_handler(), require size >= sizeof(struct joycon_input_report) before casting and parsing the input report, replacing the existing 12-byte length check.
Event History
Frequently Asked Questions
What must an attacker control to trigger the issue?
An attacker needs to provide HID input reports through a malicious or spoofed Joy-Con or Pro Controller. They control both the report type byte and the reported length; an IMU report with a declared length of 12 bytes can trigger the over-read.
What information can be exposed if the issue is triggered?
Bytes beyond the report's declared length are interpreted as accelerometer and gyroscope data and forwarded to userspace through the controller's "(IMU)" input device. This can disclose driver-internal memory contents to userspace.
Does this read extend beyond the receive-buffer allocation?
No. The receive buffers are sized for the maximum report length, so the read remains within the allocated buffer. However, it still reads data beyond the supplied report length and exposes decoded contents to userspace.