CVE-2026-64273: Input: iforce - bound the device-reported force-feedback effect index

High 7.8 EPSS 0.2% Linux kernel

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforce_process_packet() handles a status report (packet id 0x02) by taking a force-feedback effect index straight from the device wire and using it to address the per-effect state array: i = data[1] & 0x7f; if (data[1] & 0x80) { if (!test_and_set_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) ... } else if (test_and_clear_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) { ... } The index is masked only with 0x7f, so it ranges 0..127, but core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index of 32..127 the test_and_set_bit()/test_and_clear_bit() is an out-of-bounds single-bit read-modify-write past the array. core_effects[] is the second-to-last member of struct iforce, so the write lands in the trailing members and beyond the embedding kzalloc()'d iforce_serio / iforce_usb object. data[1] is unvalidated device payload on both transports (the USB interrupt endpoint and serio), and the status path is not gated on force feedback being present, so a malicious or counterfeit device can set or clear a bit at an attacker-chosen offset past the object. Reject an out-of-range index instead of indexing with it. Bound against the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so the check guarantees memory safety regardless of how many effects the device registered. A legitimate "effect started/stopped" status always carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are unaffected; the neighbouring mark_core_as_ready() loop is already bounded and is left untouched.

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

  1. Check whether you run Linux kernel and which version (commands below).
  2. Install the fixed version for your system: see “Patch it” below.
  3. Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs

Affected and fixed versions

Affected:

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64
Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)
RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernel
Fedora
sudo dnf upgrade --refresh kernel
SUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-default
Amazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12
Arch Linux
sudo pacman -Syu
Alpine
apk update && apk upgrade linux-lts linux-virt
FreeBSD
not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

ReleasePackageStatusFixed version / advisory
Debian 12linuxfixed6.1.180-1
Debian 13linuxfixed6.12.96-1
Debian testinglinuxfixed7.1.4-1
Debian 12linux-6.12fixed6.12.100-1~deb12u1

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.