CVE-2026-63943: Input: xpad - fix out-of-bounds access for Share button
High 7.1 EPSS 0.2% Linux kernel
In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length.
- CVE-2026-63943CVE identifier
- 7.1CVSS 3.1 base score (high)
- 0.2%EPSS: chance of exploitation in the next 30 days (higher than 5% of CVEs)
- 2026-07-19published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Linux kernel and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs
Affected and fixed versions
Affected:
- Linux Linux cbc82e7db16d59c301457312a624a7de2c03cd4a to before bcfb4833cd4078a1a356ef451838b75cd233099e
- Linux Linux 302a0cd0bbc450998429a3f4267970a4b93251a8 to before 37ec54abfdd63a63fd50734a9c4e4cbc1e5795af
- Linux Linux 4ef46367073b107ec22f46fe5f12176e87c238e8 to before 9749db57233b396353ad5dee81eec9d9880c9246
- Linux Linux 4ef46367073b107ec22f46fe5f12176e87c238e8 to before 6346b0895b574ce45f3747b9c508c72f70e6abef
- Linux Linux 4ef46367073b107ec22f46fe5f12176e87c238e8 to before 6cdc46b38cf146ce81d4831b6472dbf7731849a2
- Linux Linux a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8
- Linux Linux 6.6.91 to before 6.6.143
- Linux Linux 6.12.29 to before 6.12.93
- Linux Linux 6.14.7 to before 6.15
- Linux Linux 6.15
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernelFedora
sudo dnf upgrade --refresh kernelSUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-defaultAmazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12Arch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade linux-lts linux-virtFreeBSD
not LinuxGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | linux | not affected | |
| Debian 13 | linux | fixed | 6.12.94-1 |
| Debian testing | linux | fixed | 7.0.12-1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e
- https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af
- https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246
- https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef
- https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2
- CVE-2026-63943 on CVE.org
- CVE-2026-63943 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.