Skip to main content
CVE-2026-64273VulnerabilityPublished 07/25/2026

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index… (CVE-2026-64273)

Source GCVE Database

0

Not known to be exploited : patch affected systems soon.

Data as of 10/24/2026, 17:08:26 UTC

Severity
High

No CVSS score from NVD or the CNA

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

What to do

AI-suggested

A fix has been implemented that rejects out-of-range indices and properly bounds the index against the array size IFORCE_EFFECTS_MAX. Users should apply the official Linux kernel updates containing this patch to mitigate the vulnerability. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and update accordingly.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforce_process_packet() handles a status report (packet id 0x02) by taking a force-feedback effect index straight from the device wire and using it to address the per-effect state array: i = data[1] & 0x7f; if (data[1] & 0x80) { if (!test_and_set_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) ... } else if (test_and_clear_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) { ... } The index is masked only with 0x7f, so it ranges 0..127, but core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index of 32..127 the test_and_set_bit()/test_and_clear_bit() is an out-of-bounds single-bit read-modify-write past the array. core_effects[] is the second-to-last member of struct iforce, so the write lands in the trailing members and beyond the embedding kzalloc()'d iforce_serio / iforce_usb object. data[1] is unvalidated device payload on both transports (the USB interrupt endpoint and serio), and the status path is not gated on force feedback being present, so a malicious or counterfeit device can set or clear a bit at an attacker-chosen offset past the object. Reject an out-of-range index instead of indexing with it. Bound against the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so the check guarantees memory safety regardless of how many effects the device registered. A legitimate "effect started/stopped" status always carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are unaffected; the neighbouring mark_core_as_ready() loop is already bounded and is left untouched.

Impact

A malicious or counterfeit input device can send crafted force-feedback status packets with out-of-range indices, causing out-of-bounds bit read-modify-write operations in kernel memory. This can lead to memory corruption, potentially destabilizing the kernel or enabling further exploitation. Legitimate devices are unaffected as they only send indices within the valid range.

Summary

The Linux kernel iforce driver processes force-feedback effect indices reported by input devices without adequate bounds checking. Specifically, the function iforce_process_packet() masks the index to 0..127 but uses it to access an array of only 32 elements, resulting in out-of-bounds bit operations on memory beyond the array. This vulnerability arises because the device payload is unvalidated and the status path is not restricted to devices with force feedback. The fix involves rejecting indices outside the valid range and bounding the index against IFORCE_EFFECTS_MAX (32), ensuring memory safety regardless of device-reported effects.

References

Community reviews

Loading reviews…