PT-2026-44355 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46232

NVD

In the Linux kernel, the following vulnerability has been resolved:

HID: playstation: Clamp num touch reports

A device would never lie about the number of touch reports would it?

If it does the loop in dualshock4 parse report will read off the end of the touch reports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4 TOUCH POINT INACTIVE bit happens to be set. Protect against this by clamping the num touch reports value provided by the device to the maximum size of the touch reports array.

Related Identifiers

CVE-2026-46232

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46232 · Security Note
• https://git.kernel.org/stable/c/9c031b24aed6733b6dcc5d98527875b8654a04e9 · Note
• https://git.kernel.org/stable/c/7812694752a5f295eaa05a093b90a2c332666051 · Note
• https://git.kernel.org/stable/c/0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4 · Note
• https://git.kernel.org/stable/c/cac61b58a3b6340c52afa06bb15eac033158db2f · Note
• https://git.kernel.org/stable/c/208f6d5b1dfd6399bc6af9e11f27f1f496243ed0 · Note