The Linux kernel's PlayStation HID driver had a vulnerability where the num_touch_reports value provided by a device was not properly clamped. If a device lied about the number of touch reports, the dualshock4_parse_report function could read beyond the end of the touch_reports array, up to about 2 KiB for 256 iterations. This out-of-bounds read could cause data leakage via evdev if the DS4_TOUCH_POINT_INACTIVE bit was set, and also cause denial of service. The vulnerability is resolved by clamping the num_touch_reports value to the maximum size of the touch_reports array.

An attacker controlling a malicious PlayStation HID device could cause the kernel to read memory beyond the intended buffer, potentially leaking sensitive information (confidentiality impact) and causing a denial of service (availability impact). There is no indication of integrity impact. No known exploits are reported in the wild.

A fix is available that clamps the num_touch_reports value to prevent out-of-bounds reads. Users should update to Linux kernel versions 7.0.0-28.28.1 or later where this issue is resolved. Patch status is confirmed by the affectedVersions field indicating versions prior to 7.0.0-28.28.1 are vulnerable.