CVE-2026-63943: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63943 Overview

CVE-2026-63943 is an out-of-bounds access vulnerability in the Linux kernel's xpad input driver, which handles Xbox controllers over USB. The flaw resides in xpadone_process_packet(), where the function uses urb->actual_length directly to index the share-button byte at data[len - 18] or data[len - 26]. A malicious or malformed controller can send a GIP_CMD_INPUT packet with an actual_length smaller than expected (e.g., 5 bytes), causing memory reads beyond the packet's buffer. The vulnerability has been resolved upstream through bounds checking against the packet length.

Critical Impact
A physically connected or emulated USB controller can trigger kernel out-of-bounds reads, enabling potential information disclosure or kernel instability.

Affected Products

Linux kernel (mainline and stable branches containing the xpad driver)
Systems using the xpad USB input driver for Xbox controllers
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-63943 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63943

Vulnerability Analysis

The vulnerability affects the xpadone_process_packet() function in the Linux kernel xpad driver. This function processes input reports from Xbox One controllers arriving over USB. To locate the share-button state within an input packet, the code computes an index relative to the end of the buffer using data[len - 18] or data[len - 26], where len is taken from urb->actual_length.

Because len and the packet contents at data[0] are attacker-controlled through the USB device, a controller sending a short GIP_CMD_INPUT packet (for example, 5 bytes) causes the subtraction to produce an offset that falls outside the actual buffer. The kernel then reads memory adjacent to the URB data buffer, resulting in out-of-bounds access [CWE-125].

Root Cause

The root cause is missing input validation on urb->actual_length before it is used in pointer arithmetic. The driver trusts device-supplied length values without verifying that the computed share-button offset falls within the packet. The upstream fix calculates the intended offset and validates it against the packet length before dereferencing.

Attack Vector

Exploitation requires the ability to present a USB device that identifies as an Xbox controller and issues crafted GIP input packets. This typically requires local physical access, a compromised USB peripheral, or a USB-over-IP scenario. Successful exploitation can leak adjacent kernel memory contents or induce a denial of service through kernel instability.

No verified proof-of-concept exploit code is publicly available. The vulnerability mechanism is documented in the upstream commits referenced by kernel.org stable git.

Detection Methods for CVE-2026-63943

Indicators of Compromise

Kernel log entries referencing xpad or xpadone_process_packet accompanied by KASAN or slab-out-of-bounds reports.
Unexpected kernel oops or panic messages coinciding with USB controller enumeration events.
USB device connection events for devices identifying as Xbox controllers from untrusted or unknown sources.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to surface out-of-bounds accesses in the xpad driver during fuzzing or QA.
Monitor dmesg and /var/log/kern.log for driver-level warnings tied to USB HID or input subsystems.
Correlate USB device attachment telemetry with kernel warnings on endpoint hosts.

Monitoring Recommendations

Track kernel version inventory across Linux fleets to identify hosts running vulnerable builds.
Audit USB device attachments on developer, kiosk, and gaming workstations where controllers are commonly connected.
Alert on repeated xpad driver errors that may indicate a malformed device probing the vulnerable code path.

How to Mitigate CVE-2026-63943

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git commits and rebuild or update to a fixed kernel version.
Restrict physical USB access on sensitive systems and disable USB-over-IP where it is not required.
Unload the xpad module on systems that do not need Xbox controller support using modprobe -r xpad.

Patch Information

The vulnerability is resolved by upstream kernel commits 37ec54abfdd6, 6346b0895b57, 6cdc46b38cf1, 9749db57233b, and bcfb4833cd40. The fix calculates the share-button byte offset and validates it against urb->actual_length before dereferencing the buffer. Refer to the kernel.org stable tree commit for the reference implementation.

Workarounds

Blacklist the xpad kernel module on systems where Xbox controller support is not needed.
Enforce USB device allowlisting via udev rules or USBGuard to block untrusted controllers.
Deploy endpoint policies that prevent unauthorized USB HID devices from binding on servers and administrative workstations.

bash

# Blacklist the xpad module and enforce USB device policy
echo 'blacklist xpad' | sudo tee /etc/modprobe.d/blacklist-xpad.conf
sudo modprobe -r xpad
sudo update-initramfs -u

# Example USBGuard rule allowing only known controllers
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard