CVE-2026-80772
Received Received - Intake

Buffer Over-Read in Nintendo Joy-Con Linux Kernel Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cast only with a 12-byte length check: if (size >= 12) /* make sure it contains the input report */ joycon_parse_report(ctlr, (struct joycon_input_report *)data); struct joycon_input_report is 49 bytes: a 13-byte header followed by a union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report() -> joycon_parse_imu_report() walks that union (struct offsets 13..48), so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes the guard yet is read up to 37 bytes past its declared length. The over-read bytes are decoded into accelerometer/gyroscope values and forwarded to userspace through the "(IMU)" input device, leaking driver-internal memory. data[0] and size are fully controlled by a malicious or spoofed Joy-Con/Pro Controller. Receive buffers are sized to the maximum report length, so this is an over-read within the allocation rather than a slab OOB, but the decoded bytes still reach userspace. The sibling subcmd path in joycon_ctlr_handle_event() already bounds the same cast correctly: if (size < sizeof(struct joycon_input_report) || data[0] != JC_INPUT_SUBCMD_REPLY) break; Use the same sizeof(struct joycon_input_report) bound here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80772
EUVD
EUVD-2026-71415

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nintendo joycon *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in the Linux kernel's HID driver for Nintendo Joy-Con controllers. It occurs when the joycon_ctlr_read_handler() function casts an incoming HID input report to a struct joycon_input_report without proper size validation. The struct is 49 bytes, but the function only checks if the report is at least 12 bytes, allowing malicious controllers to send 12-byte reports that trigger reads up to 37 bytes past the allocated memory. This leaks internal kernel memory to userspace.

Detection Guidance

This vulnerability is specific to the Linux kernel's HID driver for Nintendo Joy-Con controllers. Detection requires checking the kernel version and verifying if the vulnerable code exists. Use uname -a to check your kernel version and grep for the vulnerable function in the kernel source or running kernel logs.

Impact Analysis

This vulnerability could allow a malicious or spoofed Joy-Con/Pro Controller to leak sensitive kernel memory to userspace. While it does not directly enable code execution or privilege escalation, the leaked memory could contain sensitive data, potentially including passwords or encryption keys. Users with untrusted USB or Bluetooth controllers may be affected.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If updating is not immediately possible, disable the joycon HID driver module by running rmmod hid-nintendo or blacklisting the module in your system's module configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart