CVE-2026-80772

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the joycon ctlr read handler() function. The function casts an incoming HID input report to struct joycon input report but only performs a 12-byte length check. Because struct joycon input report is 49 bytes, a report of exactly 12 bytes with data[0] set to JC INPUT IMU DATA can bypass the check, leading the joycon parse imu report() function to read up to 37 bytes beyond the declared length. This allows a malicious or spoofed Joy-Con or Pro Controller to control the data[0] and size variables, causing driver-internal memory to be leaked to userspace via the (IMU) input device. This is an over-read within the allocation rather than a slab out-of-bounds read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.