CVE-2026-63943
Status: Awaiting AnalysisUnscored—
In the Linux kernel, the following vulnerability has been resolved:
Input: xpad - fix out-of-bounds access for Share button
xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array.
Fix this by calculating the offset and checking bounds against the packet length.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.21%
- Percentile among all scored CVEs: 10
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
- https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af
- https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef
- https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2
- https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246
- https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e
Raw JSON (NVD)
Show
{
"id": "CVE-2026-63943",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cbc82e7db16d59c301457312a624a7de2c03cd4a",
"lessThan": "bcfb4833cd4078a1a356ef451838b75cd233099e",
"versionType": "git"
},
{
"status": "affected",
"version": "302a0cd0bbc450998429a3f4267970a4b93251a8",
"lessThan": "37ec54abfdd63a63fd50734a9c4e4cbc1e5795af",
"versionType": "git"
},
{
"status": "affected",
"version": "4ef46367073b107ec22f46fe5f12176e87c238e8",
"lessThan": "9749db57233b396353ad5dee81eec9d9880c9246",
"versionType": "git"
},
{
"status": "affected",
"version": "4ef46367073b107ec22f46fe5f12176e87c238e8",
"lessThan": "6346b0895b574ce45f3747b9c508c72f70e6abef",
"versionType": "git"
},
{
"status": "affected",
"version": "4ef46367073b107ec22f46fe5f12176e87c238e8",
"lessThan": "6cdc46b38cf146ce81d4831b6472dbf7731849a2",
"versionType": "git"
},
{
"status": "affected",
"version": "a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.91",
"lessThan": "6.6.143",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.29",
"lessThan": "6.12.93",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.14.7",
"lessThan": "6.15",
"versionType": "semver"
}
],
"programFiles": [
"drivers/input/joystick/xpad.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/input/joystick/xpad.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-19T16:17:12.880",
"references": [
{
"url": "https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: xpad - fix out-of-bounds access for Share button\n\nxpadone_process_packet() receives len directly from urb->actual_length\nand uses it to index the share-button byte at data[len - 18] or\ndata[len - 26]. Since both len and data[0] are under the device's\ncontrol, a broken controller can send a GIP_CMD_INPUT packet with\nactual_length < 18 (e.g. 5 bytes) and reach this code path, causing\naccesses beyond the actual array.\n\nFix this by calculating the offset and checking bounds against the\npacket length."
}
],
"lastModified": "2026-07-27T17:44:23.777",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}