CVE-2026-63943

Input: xpad - fix out-of-bounds access for Share button

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Jul 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: xpad - fix out-of-bounds access for Share button

xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array.

Fix this by calculating the offset and checking bounds against the packet length.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cbc82e7db16d59c301457312a624a7de2c03cd4a to before bcfb4833cd4078a1a356ef451838b75cd233099eAffected 302a0cd0bbc450998429a3f4267970a4b93251a8 to before 37ec54abfdd63a63fd50734a9c4e4cbc1e5795afAffected 4ef46367073b107ec22f46fe5f12176e87c238e8 to before 9749db57233b396353ad5dee81eec9d9880c9246Affected 4ef46367073b107ec22f46fe5f12176e87c238e8 to before 6346b0895b574ce45f3747b9c508c72f70e6abefAffected 4ef46367073b107ec22f46fe5f12176e87c238e8 to before 6cdc46b38cf146ce81d4831b6472dbf7731849a2Affected a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8Affected 6.6.91 to before 6.6.143Affected 6.12.29 to before 6.12.93Affected 6.14.7 to before 6.15Affected
LinuxLinux	6.15Affected before 6.15Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

cbc82e7db16d59c301457312a624a7de2c03cd4a to before bcfb4833cd4078a1a356ef451838b75cd233099eAffected
302a0cd0bbc450998429a3f4267970a4b93251a8 to before 37ec54abfdd63a63fd50734a9c4e4cbc1e5795afAffected
4ef46367073b107ec22f46fe5f12176e87c238e8 to before 9749db57233b396353ad5dee81eec9d9880c9246Affected
4ef46367073b107ec22f46fe5f12176e87c238e8 to before 6346b0895b574ce45f3747b9c508c72f70e6abefAffected
4ef46367073b107ec22f46fe5f12176e87c238e8 to before 6cdc46b38cf146ce81d4831b6472dbf7731849a2Affected
a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8Affected
6.6.91 to before 6.6.143Affected
6.12.29 to before 6.12.93Affected
6.14.7 to before 6.15Affected

LinuxLinux

6.15Affected
before 6.15Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.