PatchSiren cyber security CVE debrief

CVE-2026-46232 Linux CVE debrief

A vulnerability in the Linux kernel's HID PlayStation driver could allow a malicious or compromised DualShock 4 controller to trigger an out-of-bounds read of up to approximately 2 KiB. The flaw exists in `dualshock4_parse_report()` where the `num_touch_reports` value provided by the device is used without validation to iterate over the `touch_reports` array. A device reporting up to 256 touch reports would cause the loop to read beyond array bounds, with the leaked data potentially exposed through evdev if the `DS4_TOUCH_POINT_INACTIVE` bit is set in the out-of-bounds memory. The fix clamps `num_touch_reports` to the maximum valid size of the array. This vulnerability requires physical access to attach a malicious USB device and affects systems with the `hid-playstation` driver loaded.

Vendor: Linux
Product: Unknown
CVSS: HIGH 8.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-06-10
Advisory published: 2026-05-28
Advisory updated: 2026-06-10

Who should care

Organizations running Linux workstations or servers with PlayStation controller support enabled; gaming and entertainment industry infrastructure; embedded Linux systems with USB HID device support; security teams managing physical access controls for sensitive systems.

Technical summary

The `hid-playstation` driver in the Linux kernel fails to validate the `num_touch_reports` field in DualShock 4 HID reports. A malicious device can supply a value up to 255, causing `dualshock4_parse_report()` to read up to ~2 KiB beyond the `touch_reports` array. The out-of-bounds data may be emitted via evdev if bit 7 (`DS4_TOUCH_POINT_INACTIVE`) is set in the leaked bytes. The vulnerability is local, requires physical USB attachment, and could result in information disclosure from kernel memory. The fix clamps the device-provided value to `ARRAY_SIZE(touch_reports) - 1`.

Defensive priority

medium

Recommended defensive actions

Apply kernel updates containing the fix for CVE-2026-46232 when available from your Linux distribution
Verify that systems with DualShock 4 controllers or other PlayStation HID devices are running patched kernel versions
Consider restricting physical USB device access on sensitive systems until patches are applied
Monitor kernel changelogs for backported fixes to stable kernel branches (5.15, 6.1, 6.6, 6.12, etc.)
Review systems for unexpected evdev events that could indicate exploitation attempts

Evidence notes

The vulnerability description and patch references are sourced from the official CVE record and NVD entry published 2026-05-28. The fix involves clamping `num_touch_reports` in the Linux kernel's HID PlayStation driver. Five stable kernel commits are referenced, indicating backports to multiple kernel versions. No CVSS score has been assigned as of the modified date (2026-05-28T13:44:01.663Z).

Sources and references

Verified primary and authoritative sources

CVE-2026-46232 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46232

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46232 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46232

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/208f6d5b1dfd6399bc6af9e11f27f1f496243ed0

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/7812694752a5f295eaa05a093b90a2c332666051

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/9c031b24aed6733b6dcc5d98527875b8654a04e9

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/cac61b58a3b6340c52afa06bb15eac033158db2f

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.