CVE-2026-64273

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: iforce - bound the device-reported force-feedback effect index

iforce_process_packet() handles a status report (packet id 0x02) by

taking a force-feedback effect index straight from the device wire and

using it to address the per-effect state array:

i = data[1] & 0x7f;

if (data[1] & 0x80) {

if (!test_and_set_bit(FF_CORE_IS_PLAYED,

iforce->core_effects[i].flags))

...

} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,

iforce->core_effects[i].flags)) {

...

}

The index is masked only with 0x7f, so it ranges 0..127, but

core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index

of 32..127 the test_and_set_bit()/test_and_clear_bit() is an

out-of-bounds single-bit read-modify-write past the array. core_effects[]

is the second-to-last member of struct iforce, so the write lands in the

trailing members and beyond the embedding kzalloc()'d iforce_serio /

iforce_usb object.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References