PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46232 Linux CVE debrief

A vulnerability in the Linux kernel's HID PlayStation driver could allow a malicious or compromised DualShock 4 controller to trigger an out-of-bounds read of up to approximately 2 KiB. The flaw exists in `dualshock4_parse_report()` where the `num_touch_reports` value provided by the device is used without validation to iterate over the `touch_reports` array. A device reporting up to 256 touch reports would cause the loop to read beyond array bounds, with the leaked data potentially exposed through evdev if the `DS4_TOUCH_POINT_INACTIVE` bit is set in the out-of-bounds memory. The fix clamps `num_touch_reports` to the maximum valid size of the array. This vulnerability requires physical access to attach a malicious USB device and affects systems with the `hid-playstation` driver loaded.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux workstations or servers with PlayStation controller support enabled; gaming and entertainment industry infrastructure; embedded Linux systems with USB HID device support; security teams managing physical access controls for sensitive systems.

Technical summary

The `hid-playstation` driver in the Linux kernel fails to validate the `num_touch_reports` field in DualShock 4 HID reports. A malicious device can supply a value up to 255, causing `dualshock4_parse_report()` to read up to ~2 KiB beyond the `touch_reports` array. The out-of-bounds data may be emitted via evdev if bit 7 (`DS4_TOUCH_POINT_INACTIVE`) is set in the leaked bytes. The vulnerability is local, requires physical USB attachment, and could result in information disclosure from kernel memory. The fix clamps the device-provided value to `ARRAY_SIZE(touch_reports) - 1`.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fix for CVE-2026-46232 when available from your Linux distribution
  • Verify that systems with DualShock 4 controllers or other PlayStation HID devices are running patched kernel versions
  • Consider restricting physical USB device access on sensitive systems until patches are applied
  • Monitor kernel changelogs for backported fixes to stable kernel branches (5.15, 6.1, 6.6, 6.12, etc.)
  • Review systems for unexpected evdev events that could indicate exploitation attempts

Evidence notes

The vulnerability description and patch references are sourced from the official CVE record and NVD entry published 2026-05-28. The fix involves clamping `num_touch_reports` in the Linux kernel's HID PlayStation driver. Five stable kernel commits are referenced, indicating backports to multiple kernel versions. No CVSS score has been assigned as of the modified date (2026-05-28T13:44:01.663Z).

Official resources

2026-05-28