CVE-2026-80573
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called. Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.10.266,
5.15.217,
6.1.184,
6.6.153,
6.12.105,
6.18.46,
7.1.10,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-80573?
CVE-2026-80573 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.10.266, 5.15.217, 6.1.184 and others. CVE-2026-80573 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80573?
Yes. CVE-2026-80573 has been patched. Fixed versions include 5.10.266, 5.15.217, 6.1.184 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80573 actively exploited?
No. CVE-2026-80573 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.