CVE-2026-64273 - Vulnerability Details

- Input: iforce - bound the device-reported force-feedback effect index

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: iforce - bound the device-reported force-feedback effect index

iforce_process_packet() handles a status report (packet id 0x02) by
taking a force-feedback effect index straight from the device wire and
using it to address the per-effect state array:

i = data[1] & 0x7f;
if (data[1] & 0x80) {
if (!test_and_set_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags))
...
} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags)) {
...
}

The index is masked only with 0x7f, so it ranges 0..127, but
core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index
of 32..127 the test_and_set_bit()/test_and_clear_bit() is an
out-of-bounds single-bit read-modify-write past the array. core_effects[]
is the second-to-last member of struct iforce, so the write lands in the
trailing members and beyond the embedding kzalloc()'d iforce_serio /
iforce_usb object.

data[1] is unvalidated device payload on both transports (the USB
interrupt endpoint and serio), and the status path is not gated on force
feedback being present, so a malicious or counterfeit device can set or
clear a bit at an attacker-chosen offset past the object.

Reject an out-of-range index instead of indexing with it. Bound against
the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so
the check guarantees memory safety regardless of how many effects the
device registered. A legitimate "effect started/stopped" status always
carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are
unaffected; the neighbouring mark_core_as_ready() loop is already bounded
and is left untouched.

Published: 2026-07-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The iforce driver in the Linux kernel incorrectly processes status report packets that include a force‑feedback effect index. The index is masked only to 0x7f, allowing values up to 127, but the per‑effect array holds only 32 entries. A crafted packet that supplies an out‑of‑range index causes a bit read‑modify‑write past the end of the array, corrupting kernel memory. This is a classic out‑of-bounds memory write (CWE‑787) due to unvalidated array index (CWE‑129) that can lead to arbitrary kernel memory corruption if triggered.

Affected Systems

All installations of the Linux kernel that contain the iforce driver prior to the patch are affected. Any system running a kernel version that has not applied the recent fix and that can accept USB or serial devices claiming force‑feedback capabilities is potentially vulnerable.

Risk and Exploitability

The EPSS score is less than 1%, and the flaw is not listed in CISA KEV, indicating a low likelihood of active exploitation in the wild. The vulnerability is triggered through a direct device connection, without the need for network access. An attacker needs only a counterfeit or malicious USB or serial device that advertises the driver’s interface and can send a crafted status report with a high index to exploit the out‑of‑bounds write and corrupt kernel memory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d10b0507fa0f5b46764b178e3271f9012f2df677
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6c0f2901c9d325d4a0574c4237fd507810d225ff
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c21295616a8a52b9a5f18cd4ca8c73030eda3d4f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e5fa31f0550b55d80045669ae9080dd5b88abffa
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 70019779325f2bb5f5a4098e91e79c655f50fcef
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a40250f97c312e000e3616c9074022311a0efbc3
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0e9943d2e4c63496b6ca84bc66fd3c71d40558e2

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d10b0507fa0f5b46764b178e3271f9012f2df677)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6c0f2901c9d325d4a0574c4237fd507810d225ff)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c21295616a8a52b9a5f18cd4ca8c73030eda3d4f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e5fa31f0550b55d80045669ae9080dd5b88abffa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,70019779325f2bb5f5a4098e91e79c655f50fcef)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a40250f97c312e000e3616c9074022311a0efbc3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0e9943d2e4c63496b6ca84bc66fd3c71d40558e2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the fix
Reboot the system after the kernel upgrade to ensure the updated kernel is running
If an immediate kernel update is not possible, disable force‑feedback devices until the patch is applied

Generated by OpenCVE AI on August 13, 2026 at 20:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2
https://git.kernel.org/stable/c/6c0f2901c9d325d4a0574c4237fd507810d225ff
https://git.kernel.org/stable/c/70019779325f2bb5f5a4098e91e79c655f50fcef
https://git.kernel.org/stable/c/a40250f97c312e000e3616c9074022311a0efbc3
https://git.kernel.org/stable/c/b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310
https://git.kernel.org/stable/c/c21295616a8a52b9a5f18cd4ca8c73030eda3d4f
https://git.kernel.org/stable/c/d10b0507fa0f5b46764b178e3271f9012f2df677
https://git.kernel.org/stable/c/e5fa31f0550b55d80045669ae9080dd5b88abffa
https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64273-0188@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64273
https://www.cve.org/CVERecord?id=CVE-2026-64273

History

Thu, 13 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-129
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.12:-:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 03 Aug 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Thu, 30 Jul 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026072500-CVE-2026-64273-0188@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64273 https://www.cve.org/CVERecord?id=CVE-2026-64273

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforce_process_packet() handles a status report (packet id 0x02) by taking a force-feedback effect index straight from the device wire and using it to address the per-effect state array: i = data[1] & 0x7f; if (data[1] & 0x80) { if (!test_and_set_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) ... } else if (test_and_clear_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) { ... } The index is masked only with 0x7f, so it ranges 0..127, but core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index of 32..127 the test_and_set_bit()/test_and_clear_bit() is an out-of-bounds single-bit read-modify-write past the array. core_effects[] is the second-to-last member of struct iforce, so the write lands in the trailing members and beyond the embedding kzalloc()'d iforce_serio / iforce_usb object. data[1] is unvalidated device payload on both transports (the USB interrupt endpoint and serio), and the status path is not gated on force feedback being present, so a malicious or counterfeit device can set or clear a bit at an attacker-chosen offset past the object. Reject an out-of-range index instead of indexing with it. Bound against the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so the check guarantees memory safety regardless of how many effects the device registered. A legitimate "effect started/stopped" status always carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are unaffected; the neighbouring mark_core_as_ready() loop is already bounded and is left untouched.
Title		Input: iforce - bound the device-reported force-feedback effect index
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2 https://git.kernel.org/stable/c/6c0f2901c9d325d4a0574c4237fd507810d225ff https://git.kernel.org/stable/c/70019779325f2bb5f5a4098e91e79c655f50fcef https://git.kernel.org/stable/c/a40250f97c312e000e3616c9074022311a0efbc3 https://git.kernel.org/stable/c/b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310 https://git.kernel.org/stable/c/c21295616a8a52b9a5f18cd4ca8c73030eda3d4f https://git.kernel.org/stable/c/d10b0507fa0f5b46764b178e3271f9012f2df677 https://git.kernel.org/stable/c/e5fa31f0550b55d80045669ae9080dd5b88abffa

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:19.416Z

Updated: 2026-07-25T08:49:19.416Z

Reserved: 2026-07-19T15:36:31.776Z

Link: CVE-2026-64273

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:07.660

Modified: 2026-08-13T18:27:43.250

Link: CVE-2026-64273

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64273 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T20:15:03Z

Weaknesses

CWE-129
Improper Validation of Array Index
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object