CVE-2026-63943

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Input: xpad - fix out-of-bounds access for Share button

xpadone_process_packet() receives len directly from urb->actual_length

and uses it to index the share-button byte at data[len - 18] or

data[len - 26]. Since both len and data[0] are under the device's

control, a broken controller can send a GIP_CMD_INPUT packet with

actual_length < 18 (e.g. 5 bytes) and reach this code path, causing

accesses beyond the actual array.

Fix this by calculating the offset and checking bounds against the

packet length.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References