CVE-2026-46232 Details
Description
In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device would never lie about the number of touch reports would it? If it does the loop in dualshock4_parse_report will read off the end of the touch_reports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by clamping the num_touch_reports value provided by the device to the maximum size of the touch_reports array.
A vulnerability in the Linux kernel's handling of PlayStation DualShock 4 controllers can lead to a buffer overflow. The issue arises in the 'dualshock4_parse_report' function, where the number of touch reports from the controller is not properly validated. This can cause the function to read past the end of the touch reports array, potentially leaking data through the evdev interface if certain conditions are met. The vulnerability affects the HID subsystem, specifically in the management of DualShock 4 touchpad input.
Users can upgrade to the latest version of the Linux kernel, where this vulnerability has been addressed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/208f6d5b1dfd6399bc6af9e11f27f1f496243ed0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7812694752a5f295eaa05a093b90a2c332666051 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9c031b24aed6733b6dcc5d98527875b8654a04e9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cac61b58a3b6340c52afa06bb15eac033158db2f | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.2, < 6.6.140 >= 6.7, < 6.12.90 >= 6.13, < 6.18.32 >= 6.19, < 7.0.9 7.1 rc1 7.1 rc2 7.1 rc3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| May 30, 2026 | CVE Modified | kernel.org |
| May 28, 2026 | New CVE Received | kernel.org |