CVE-2026-80573

A flaw was found in the Linux kernel's iforce driver, which handles input devices such as joysticks and wheels. This vulnerability occurs because the iforce_process_packet() function processes incoming data packets without adequately validating their lengths. A local attacker could exploit this by sending specially crafted input packets or a zero-length USB Request Block (URB). This could lead to an out-of-bounds read, potentially causing a denial of service or system instability.

A moderate severity vulnerability was found in the Linux kernel's iforce driver, which processes input from USB force-feedback devices such as joysticks and wheels. The iforce_process_packet() function reads fixed fields from joystick, wheel, and status packets without first validating their lengths: the shared hats-and-buttons helper unconditionally reads data[6], an incomplete final 16-bit effect address in the status tail is consumed, and the packet ID is read from a successful zero-length USB URB before the common parser is called. A local attacker able to supply specially crafted input packets or a zero-length USB URB, for example by connecting a malicious USB input device, could use this flaw to trigger an out-of-bounds read, resulting in a denial of service or system instability. Red Hat rates this flaw with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All Red Hat products in scope -- Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) -- are not affected because the vulnerable code is not present in the shipped kernels, so no Red Hat product updates are required for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.