CVE-2026-64273

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read-modify-write issue exists in the iforce process packet() function when handling status reports (packet id 0x02). The function uses a force-feedback effect index obtained from the device wire to address the core effects[] array. While the index is masked to a range of 0 to 127, the array only contains 32 entries. A malicious or counterfeit device can provide an index between 32 and 127 via the data[1] variable, allowing an attacker to set or clear a bit at an offset beyond the iforce serio or iforce usb objects. This occurs because the data[1] payload is unvalidated on both USB interrupt endpoints and serio transports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.