CVE-2026-46232: Linux Kernel PlayStation HID Buffer Over-Read Information Disclosure

Technical summary

The vulnerability exists in the dualshock4_parse_report function within the HID PlayStation driver (drivers/hid/hid-playstation.c). The kernel trusts a device-supplied num_touch_reports value without validation, allowing an out-of-bounds read when iterating over the touch_reports array. The touch_reports array has a fixed size limit, but the device can claim more reports than that limit. During iteration, if the DS4_TOUCH_POINT_INACTIVE bit is set in out-of-bounds memory regions, that data is emitted through the evdev subsystem, resulting in information disclosure. The fix implements clamping to ensure num_touch_reports never exceeds the array bounds.

Business impact

This vulnerability primarily affects systems using PlayStation controllers with the Linux kernel. While the attack requires either physical device access or the ability to connect a malicious USB device, successful exploitation can leak sensitive kernel memory contents. For systems in shared computing environments, data centers, or kiosk-style deployments where untrusted users might plug in devices, this creates a confidentiality risk. The vulnerability does not enable code execution or direct denial of service, but the memory leak could facilitate further privilege escalation attacks if the leaked data contains kernel address space layout information or other secrets.

Affected systems

All Linux kernel versions are affected through the HID PlayStation driver subsystem. The vulnerability impacts any system running the linux_kernel package with the HID PlayStation driver enabled and configured to accept input from PlayStation DualShock 4 controllers via USB or Bluetooth HID transport. Systems without PlayStation controller support or those not loading the hid-playstation driver module are unaffected.

Exploitability

Exploitation requires either physical access to connect a USB device or prior compromise allowing device emulation. The attacker must craft a malicious HID device that reports an inflated num_touch_reports value and sets the DS4_TOUCH_POINT_INACTIVE bit in out-of-bounds memory regions to trigger information disclosure. The attack is deterministic once a device is connected; no user interaction is required. This is moderately exploitable in controlled environments but has limited real-world impact for systems in restrictive physical security postures. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Apply the Linux kernel patch that implements clamping of the num_touch_reports value to the maximum size of the touch_reports array. This validation should be performed during device initialization or report parsing to reject any device-supplied value exceeding the array bounds. Verify that your kernel version includes the fix by checking the upstream commit or your distribution's security advisory. For systems not requiring PlayStation controller support, disabling or removing the hid-playstation module eliminates the attack surface entirely.

Patch guidance

Obtain updates from your Linux distribution's security repository. Distributions maintain their own backport schedules; verify the patch status in your vendor's advisory. For systems running directly from upstream Linux sources, apply the commit that adds the clamping logic to dualshock4_parse_report. Test the patched kernel with connected PlayStation controllers to ensure touch input remains functional. If using modular builds, verify that hid-playstation is rebuilt with the updated source.

Detection guidance

Monitor kernel logs for any unusual memory access patterns or HID device initialization failures. Implement device allowlisting policies to restrict which USB HID devices are permitted to connect. Use udev rules to block or restrict PlayStation HID devices if they are not required. Audit systems for active hid-playstation module loading; unload the module on systems where it is not needed. Consider deploying endpoint detection tools that monitor for suspicious USB device connections from untrusted sources.

Why prioritize this

While the CVSS score of 8.1 indicates a HIGH severity vulnerability due to the combination of information disclosure and potential system impact, real-world exploitability is limited by the requirement for physical device access or prior compromise. Organizations should prioritize patching based on their threat model: high-priority for systems in high-security environments where device attachment is possible, moderate-priority for datacenter and cloud environments with restricted physical access. The lack of KEV status and public exploits suggests limited immediate threat activity.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects a high-impact information disclosure vulnerability with high attack complexity requirements (Physical proximity: AV:A). The score accounts for confidentiality impact (C:H) and availability impact (A:H), though the latter is limited to potential denial of service through device misbehavior rather than kernel crash. The score does not penalize for the requirement of physical device access, which would significantly lower real-world exploitability in most enterprise environments.

Frequently asked questions