CVE-2026-63943 - Vulnerability Details

- Input: xpad - fix out-of-bounds access for Share button

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: xpad - fix out-of-bounds access for Share button

xpadone_process_packet() receives len directly from urb->actual_length
and uses it to index the share-button byte at data[len - 18] or
data[len - 26]. Since both len and data[0] are under the device's
control, a broken controller can send a GIP_CMD_INPUT packet with
actual_length < 18 (e.g. 5 bytes) and reach this code path, causing
accesses beyond the actual array.

Fix this by calculating the offset and checking bounds against the
packet length.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cbc82e7db16d59c301457312a624a7de2c03cd4a`	affected	< bcfb4833cd4078a1a356ef451838b75cd233099e
`302a0cd0bbc450998429a3f4267970a4b93251a8`	affected	< 37ec54abfdd63a63fd50734a9c4e4cbc1e5795af
`4ef46367073b107ec22f46fe5f12176e87c238e8`	affected	< 9749db57233b396353ad5dee81eec9d9880c9246
`4ef46367073b107ec22f46fe5f12176e87c238e8`	affected	< 6346b0895b574ce45f3747b9c508c72f70e6abef
`4ef46367073b107ec22f46fe5f12176e87c238e8`	affected	< 6cdc46b38cf146ce81d4831b6472dbf7731849a2
`a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8`	affected	—
`6.6.91`	affected	< 6.6.143
`6.12.29`	affected	< 6.12.93
`6.14.7`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cbc82e7db16d59c301457312a624a7de2c03cd4a,bcfb4833cd4078a1a356ef451838b75cd233099e)`	affected	code_commit	—
`[302a0cd0bbc450998429a3f4267970a4b93251a8,37ec54abfdd63a63fd50734a9c4e4cbc1e5795af)`	affected	code_commit	—
`[4ef46367073b107ec22f46fe5f12176e87c238e8,9749db57233b396353ad5dee81eec9d9880c9246)`	affected	code_commit	—
`[4ef46367073b107ec22f46fe5f12176e87c238e8,6346b0895b574ce45f3747b9c508c72f70e6abef)`	affected	code_commit	—
`[4ef46367073b107ec22f46fe5f12176e87c238e8,6cdc46b38cf146ce81d4831b6472dbf7731849a2)`	affected	code_commit	—
`a7e3ddd1d9a3d0b26465ed01d464e3c05479ebc8`	affected	code_commit	—
`[6.6.91,6.6.143)`	affected	semver	—
`[6.12.29,6.12.93)`	affected	semver	—
`[6.14.7,6.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.15,6.15]`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.6.143,7.0.0)`	unaffected	generic	—
`[6.12.93,7.0.0)`	unaffected	generic	—
`[6.18.35,7.0.0)`	unaffected	generic	—
`[7.0.12,8.0.0)`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af
https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef
https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2
https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246
https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e
https://lore.kernel.org/linux-cve-announce/2026071953-CVE-2026-63943-6827@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63943
https://www.cve.org/CVERecord?id=CVE-2026-63943

History

Wed, 22 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071953-CVE-2026-63943-6827@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63943 https://www.cve.org/CVERecord?id=CVE-2026-63943
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length.
Title		Input: xpad - fix out-of-bounds access for Share button
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2 https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246 https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:38.411Z

Updated: 2026-07-19T14:55:38.411Z

Reserved: 2026-07-19T07:54:57.022Z

Link: CVE-2026-63943

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63943 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-22T18:30:03Z

Weaknesses

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object