CVE-2026-63943

{"id": "CVE-2026-63943", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cbc82e7db16d59c301457312a624a7de2c03cd4a", "lessThan": "bcfb4833cd4078a1a356ef451838b75cd233099e", "versionType": "git"}, {"status": "affected", "version": "302a0cd0bbc450998429a3f4267970a4b93251a8", "lessThan": "37ec54abfdd63a63fd50734a9c4e4cbc1e5795af", "versionType": "git"}, {"status": "affected", "version": "4ef46367073b107ec22f46fe5f12176e87c238e8", "lessThan": "9749db57233b396353ad5dee81eec9d9880c9246", "versionType": "git"}, {"status": "affected", "version": "4ef46367073b107ec22f46fe5f12176e87c238e8", "lessThan": "6346b0895b574ce45f3747b9c508c72f70e6abef", "versionType": "git"}, {"status": "affected", "version": "4ef46367073b107ec22f46fe5f12176e87c238e8", "lessThan": "6cdc46b38cf146ce81d4831b6472dbf7731849a2", "versionType": "git"}, {"status": "affected", "version": "a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8", "versionType": "git"}, {"status": "affected", "version": "6.6.91", "lessThan": "6.6.143", "versionType": "semver"}, {"status": "affected", "version": "6.12.29", "lessThan": "6.12.93", "versionType": "semver"}, {"status": "affected", "version": "6.14.7", "lessThan": "6.15", "versionType": "semver"}], "programFiles": ["drivers/input/joystick/xpad.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/input/joystick/xpad.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T16:17:12.880", "references": [{"url": "https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: xpad - fix out-of-bounds access for Share button\n\nxpadone_process_packet() receives len directly from urb->actual_length\nand uses it to index the share-button byte at data[len - 18] or\ndata[len - 26]. Since both len and data[0] are under the device's\ncontrol, a broken controller can send a GIP_CMD_INPUT packet with\nactual_length < 18 (e.g. 5 bytes) and reach this code path, causing\naccesses beyond the actual array.\n\nFix this by calculating the offset and checking bounds against the\npacket length."}], "lastModified": "2026-10-30T14:28:01.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FB2D5A4-83E0-443D-8F98-FA6AD561F63D", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.6.91"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E8823B6-49CD-4DED-B15C-BFD10BC1D6FD", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.12.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FDC6072-C8E3-47C6-A833-1BE068BA9B9A", "versionEndExcluding": "6.15", "versionStartIncluding": "6.14.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70B1D296-484B-48F3-8EEA-5AF0CCCA903A", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.15.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}