The Linux kernel’s xpad driver uses the length field from a USB GIP_CMD_INPUT packet to index into a data buffer. If a controller sends a packet whose actual_length is shorter than the minimum expected (less than 18 bytes), the driver reads bytes beyond the end of the buffer. This out-of-bounds read can corrupt kernel memory, though the official description does not indicate that it leads to code execution or privilege escalation. The likely attack vector is a malicious USB device that sends a specially crafted packet.

Linux systems that ship with the unmodified xpad USB driver are affected, regardless of distribution. The flaw is triggered when a USB controller is attached and sends a specially crafted packet to the target machine. Based on the description, the attack vector is a physical USB access from a malicious controller device.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a physical USB device capable of sending a malformed packet, and the only documented consequence is potential kernel memory corruption. The published patch restores bounds checking to prevent the overflow. The likely attack vector is a USB controller that can send crafted packets.