CVE-2026-80772 - Vulnerability Details

- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

joycon_ctlr_read_handler() casts an incoming HID input report to
struct joycon_input_report and parses it, guarding the cast only with a
12-byte length check:

if (size >= 12) /* make sure it contains the input report */
joycon_parse_report(ctlr, (struct joycon_input_report *)data);

struct joycon_input_report is 49 bytes: a 13-byte header followed by a
union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report()
-> joycon_parse_imu_report() walks that union (struct offsets 13..48),
so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes
the guard yet is read up to 37 bytes past its declared length. The
over-read bytes are decoded into accelerometer/gyroscope values and
forwarded to userspace through the "(IMU)" input device, leaking
driver-internal memory. data[0] and size are fully controlled by a
malicious or spoofed Joy-Con/Pro Controller.

Receive buffers are sized to the maximum report length, so this is an
over-read within the allocation rather than a slab OOB, but the decoded
bytes still reach userspace.

The sibling subcmd path in joycon_ctlr_handle_event() already bounds the
same cast correctly:

if (size < sizeof(struct joycon_input_report) ||
data[0] != JC_INPUT_SUBCMD_REPLY)
break;

Use the same sizeof(struct joycon_input_report) bound here.

Published: 2026-09-04

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel HID driver for Nintendo Joy‑Con and Pro Controllers performs a premature length check in the joycon_ctlr_read_handler routine, allowing an attacker to supply a 12‑byte report that is incorrectly processed as a 49‑byte IMU report. The over‑read propagates kernel memory into the (IMU) input device and forwards the data to userspace, causing a kernel memory disclosure. The flaw arises from the absence of a sizeof() comparison for the structure being parsed.

Affected Systems

All Linux kernel builds that include the HID driver for Nintendo Joy‑Con or Pro Controllers and that have not applied the commit adding a proper sizeof(struct joycon_input_report) guard are vulnerable. This includes all kernels released before the patch, regardless of major version.

Risk and Exploitability

An attacker only needs the ability to send a crafted HID report to a connected or spoofed Joy‑Con/Pro controller; no elevated privileges are required. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the low barrier to exploitation and kernel memory leakage give the flaw a moderate‑to‑high risk potential.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< 33ea29f8b6141f2d265de807e110a6435b355cb0
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< bd397c4123a4bc084913d8c7fdb40ef94e9f8172
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< addca61f9a23c0d20a387c2040e70479f54518e1
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< 51cfd1adbe7a46bb08af162abb3ab3b6820e2d15
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< d4cabd4089adb59cf7974915737c52cc47a9bb1b
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< 34725ed4719da424113db8449fb5485aaf71a913
`2af16c1f846bd60240745bbd3afa13d5f040c61a`	affected	< 27b376b945c0aac46fcdfcc950b14a85b874b557

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`6.1.185`	unaffected	≤ 6.1.*
`6.6.154`	unaffected	≤ 6.6.*
`6.12.106`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,33ea29f8b6141f2d265de807e110a6435b355cb0)`	affected	code_commit	—
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,bd397c4123a4bc084913d8c7fdb40ef94e9f8172)`	affected	code_commit	—
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,addca61f9a23c0d20a387c2040e70479f54518e1)`	affected	code_commit	—
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,51cfd1adbe7a46bb08af162abb3ab3b6820e2d15)`	affected	code_commit	—
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,d4cabd4089adb59cf7974915737c52cc47a9bb1b)`	affected	code_commit	—
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,34725ed4719da424113db8449fb5485aaf71a913)`	affected	code_commit	—
`[2af16c1f846bd60240745bbd3afa13d5f040c61a,27b376b945c0aac46fcdfcc950b14a85b874b557)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.16`	affected	generic	—
`[0,5.16)`	unaffected	generic	—
`[6.1.185,6.2.0)`	unaffected	semver	—
`[6.6.154,6.7.0)`	unaffected	semver	—
`[6.12.106,6.13.0)`	unaffected	semver	—
`[6.18.47,6.19.0)`	unaffected	semver	—
`[7.1.11,7.2.0)`	unaffected	semver	—
`[7.2.1,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that incorporates the patch fixing the bounds check in joycon_ctlr_read_handler()
If a kernel upgrade cannot be performed immediately, disable or block Nintendo Joy‑Con/Pro controller devices to prevent malicious HID reports from being processed
Use device isolation or firewall rules to restrict Bluetooth HID traffic from untrusted sources

Generated by OpenCVE AI on September 4, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/27b376b945c0aac46fcdfcc950b14a85b874b557
https://git.kernel.org/stable/c/33ea29f8b6141f2d265de807e110a6435b355cb0
https://git.kernel.org/stable/c/34725ed4719da424113db8449fb5485aaf71a913
https://git.kernel.org/stable/c/51cfd1adbe7a46bb08af162abb3ab3b6820e2d15
https://git.kernel.org/stable/c/addca61f9a23c0d20a387c2040e70479f54518e1
https://git.kernel.org/stable/c/bd397c4123a4bc084913d8c7fdb40ef94e9f8172
https://git.kernel.org/stable/c/d4cabd4089adb59cf7974915737c52cc47a9bb1b

History

Fri, 04 Sep 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cast only with a 12-byte length check: if (size >= 12) /* make sure it contains the input report / joycon_parse_report(ctlr, (struct joycon_input_report )data); struct joycon_input_report is 49 bytes: a 13-byte header followed by a union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report() -> joycon_parse_imu_report() walks that union (struct offsets 13..48), so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes the guard yet is read up to 37 bytes past its declared length. The over-read bytes are decoded into accelerometer/gyroscope values and forwarded to userspace through the "(IMU)" input device, leaking driver-internal memory. data[0] and size are fully controlled by a malicious or spoofed Joy-Con/Pro Controller. Receive buffers are sized to the maximum report length, so this is an over-read within the allocation rather than a slab OOB, but the decoded bytes still reach userspace. The sibling subcmd path in joycon_ctlr_handle_event() already bounds the same cast correctly: if (size < sizeof(struct joycon_input_report) \|\| data[0] != JC_INPUT_SUBCMD_REPLY) break; Use the same sizeof(struct joycon_input_report) bound here.
Title		HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/27b376b945c0aac46fcdfcc950b14a85b874b557 https://git.kernel.org/stable/c/33ea29f8b6141f2d265de807e110a6435b355cb0 https://git.kernel.org/stable/c/34725ed4719da424113db8449fb5485aaf71a913 https://git.kernel.org/stable/c/51cfd1adbe7a46bb08af162abb3ab3b6820e2d15 https://git.kernel.org/stable/c/addca61f9a23c0d20a387c2040e70479f54518e1 https://git.kernel.org/stable/c/bd397c4123a4bc084913d8c7fdb40ef94e9f8172 https://git.kernel.org/stable/c/d4cabd4089adb59cf7974915737c52cc47a9bb1b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:12:44.445Z

Updated: 2026-09-04T15:12:44.445Z

Reserved: 2026-08-26T14:34:25.792Z

Link: CVE-2026-80772

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:02.743

Modified: 2026-09-04T16:18:02.743

Link: CVE-2026-80772

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T21:30:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object