CVE-2026-80772HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cast only with a 12-byte length check: if (size >= 12) /* make sure it contains the input report */ joycon_parse_report(ctlr, (struct joycon_input_report *)data); struct joycon_input_report is 49 bytes: a 13-byte header followed by a union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report() -> joycon_parse_imu_report() walks that union (struct offsets 13..48), so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes the guard yet is read up to 37 bytes past its declared length. The over-read bytes are decoded into accelerometer/gyroscope values and forwarded to userspace through the "(IMU)" input device, leaking driver-internal memory. data[0] and size are fully controlled by a malicious or spoofed Joy-Con/Pro Controller. Receive buffers are sized to the maximum report length, so this is an over-read within the allocation rather than a slab OOB, but the decoded bytes still reach userspace. The sibling subcmd path in joycon_ctlr_handle_event() already bounds the same cast correctly: if (size < sizeof(struct joycon_input_report) || data[0] != JC_INPUT_SUBCMD_REPLY) break; Use the same sizeof(struct joycon_input_report) bound here.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 33ea29f8b6141f2d265de807e110a6435b355cb0; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before bd397c4123a4bc084913d8c7fdb40ef94e9f8172; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before addca61f9a23c0d20a387c2040e70479f54518e1; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 51cfd1adbe7a46bb08af162abb3ab3b6820e2d15; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before d4cabd4089adb59cf7974915737c52cc47a9bb1b; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 34725ed4719da424113db8449fb5485aaf71a913; from 2af16c1f846bd60240745bbd3afa13d5f040c61a before 27b376b945c0aac46fcdfcc950b14a85b874b557 | CNA record |
References
- https://git.kernel.org/stable/c/33ea29f8b6141f2d265de807e110a6435b355cb0
- https://git.kernel.org/stable/c/bd397c4123a4bc084913d8c7fdb40ef94e9f8172
- https://git.kernel.org/stable/c/addca61f9a23c0d20a387c2040e70479f54518e1
- https://git.kernel.org/stable/c/51cfd1adbe7a46bb08af162abb3ab3b6820e2d15
- https://git.kernel.org/stable/c/d4cabd4089adb59cf7974915737c52cc47a9bb1b
- https://git.kernel.org/stable/c/34725ed4719da424113db8449fb5485aaf71a913
- https://git.kernel.org/stable/c/27b376b945c0aac46fcdfcc950b14a85b874b557
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.