CVE-2026-80573

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: iforce - validate input packet lengths

iforce_process_packet() reads fixed fields from joystick, wheel and

status packets without first checking their lengths. In particular, the

shared hats-and-buttons helper unconditionally reads data[6]. The status

tail is a sequence of 16-bit effect addresses, but an incomplete final

address is also consumed. A successful zero-length USB URB additionally

reads the packet ID before the common parser is called.

Reject the zero-length USB transfer, require the seven-byte joystick and

wheel prefixes and the two-byte status prefix, and consume only complete

status-tail addresses.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References