CVE-2026-80772

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

joycon_ctlr_read_handler() casts an incoming HID input report to

struct joycon_input_report and parses it, guarding the cast only with a

12-byte length check:

if (size >= 12) /* make sure it contains the input report */

joycon_parse_report(ctlr, (struct joycon_input_report *)data);

struct joycon_input_report is 49 bytes: a 13-byte header followed by a

union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report()

-> joycon_parse_imu_report() walks that union (struct offsets 13..48),

so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes

the guard yet is read up to 37 bytes past its declared length. The

over-read bytes are decoded into accelerometer/gyroscope values and

forwarded to userspace through the "(IMU)" input device, leaking

driver-internal memory. data[0] and size are fully controlled by a

malicious or spoofe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References