CVE-2026-63943

A flaw was found in the Linux kernel's xpad input driver. A local attacker with a specially crafted or malicious Xbox One controller could send a malformed input packet. This could lead to an out-of-bounds read, potentially causing a denial of service (DoS) or information disclosure.

This vulnerability is rated as Moderate impact because triggering the flaw requires local attachment of an untrusted USB gamepad, restricting the blast radius to a system crash rather than remote compromise. Enterprise servers and container host environments typically do not utilize joystick hardware, making exposure minimal in standard Red Hat deployments. Supported Red Hat Enterprise Linux distributions do not contain the upstream commit that introduced this flaw and are therefore not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.