The Linux kernel iforce driver processes force-feedback effect indices reported by input devices without adequate bounds checking. Specifically, the function iforce_process_packet() masks the index to 0..127 but uses it to access an array of only 32 elements, resulting in out-of-bounds bit operations on memory beyond the array. This vulnerability arises because the device payload is unvalidated and the status path is not restricted to devices with force feedback. The fix involves rejecting indices outside the valid range and bounding the index against IFORCE_EFFECTS_MAX (32), ensuring memory safety regardless of device-reported effects.

A malicious or counterfeit input device can send crafted force-feedback status packets with out-of-range indices, causing out-of-bounds bit read-modify-write operations in kernel memory. This can lead to memory corruption, potentially destabilizing the kernel or enabling further exploitation. Legitimate devices are unaffected as they only send indices within the valid range.

A fix has been implemented that rejects out-of-range indices and properly bounds the index against the array size IFORCE_EFFECTS_MAX. Users should apply the official Linux kernel updates containing this patch to mitigate the vulnerability. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and update accordingly.