Tracker / CVE-2026-46232
CVE-2026-46232
High 8.1
In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device would never lie about the number of touch reports would it? If it does the loop in dualshock4_parse_report will read off the end of the touch_reports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by clamping the num_touch_reports value provided by the device to the maximum size of the touch_reports array.
Affected products and versions
| linux | linux_kernel |
|---|---|
| linux | linux_kernel · 6.13 → 6.18.32 |
| linux | linux_kernel · 6.19 → 7.0.9 |
| linux | linux_kernel · 6.2 → 6.6.140 |
| linux | linux_kernel · 6.7 → 6.12.90 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.