CVE-2026-64273: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64273 Overview

CVE-2026-64273 is an out-of-bounds write vulnerability in the Linux kernel's iforce input driver, which supports I-Force force-feedback joystick devices over USB and serio transports. The flaw resides in iforce_process_packet(), which accepts a status report (packet id 0x02) and uses a device-supplied effect index to address the core_effects[] array without proper bounds checking. A malicious or counterfeit device can trigger a single-bit read-modify-write at an attacker-chosen offset past the iforce_serio or iforce_usb object.

Critical Impact
A malicious USB or serio force-feedback device can set or clear arbitrary bits in kernel memory past the driver object, enabling potential kernel memory corruption from a physically attached device.

Affected Products

Linux kernel versions containing the iforce input driver prior to the referenced stable commits
Systems using USB or serio I-Force force-feedback joysticks with the iforce driver
Distributions shipping unpatched Linux kernel branches referenced by commits 0e9943d2, 6c0f2901, 70019779, a40250f9, b1b79e89, c2129561, d10b0507, and e5fa31f0

Discovery Timeline

2026-07-25 - CVE-2026-64273 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64273

Vulnerability Analysis

The iforce_process_packet() function processes status reports from I-Force force-feedback devices. When packet id 0x02 arrives, the function extracts an effect index from data[1] by masking with 0x7f, producing values in the range 0..127. It then uses this index to access iforce->core_effects[i].flags and calls test_and_set_bit() or test_and_clear_bit() on that member.

The core_effects[] array is statically sized to IFORCE_EFFECTS_MAX, which is 32 entries. Any index between 32 and 127 addresses memory outside the array. Because core_effects[] is the second-to-last member of struct iforce, the resulting out-of-bounds bit operation lands in the trailing members of the structure and beyond the containing kzalloc()'d iforce_serio or iforce_usb allocation.

Root Cause

The root cause is missing input validation on untrusted device payload. The driver treats data[1] as a trusted control field and only strips its high bit, without validating that the effect index falls within the array bound. The status path is also not gated on force feedback being registered, so the code executes for any device sending the status packet id regardless of capabilities.

Attack Vector

An attacker with the ability to attach a malicious USB device, a counterfeit peripheral, or a compromised serio-attached device can send a crafted status report. Setting data[1] in the range 0x20..0x7f (with or without the 0x80 play bit) drives test_and_set_bit() or test_and_clear_bit() against an attacker-selected offset past the driver object. This yields a controlled single-bit flip primitive in adjacent kernel heap memory, which can be leveraged for memory corruption or potential privilege escalation depending on adjacent allocations.

See the upstream fix commit for the exact patch, which rejects any index equal to or greater than IFORCE_EFFECTS_MAX before performing the bit operation.

Detection Methods for CVE-2026-64273

Indicators of Compromise

Kernel log entries referencing the iforce driver alongside slab or KASAN out-of-bounds reports on iforce_serio or iforce_usb allocations
Unexpected USB device enumeration presenting as an I-Force joystick on systems that do not normally use such peripherals
Kernel oops or panic traces with iforce_process_packet in the call stack

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to catch out-of-bounds bit operations in the iforce driver during fuzzing or device attach.
Audit USB device attach events for descriptors matching the I-Force class on hosts where such devices are not expected.
Correlate dmesg output with USB enumeration events to identify anomalous status packets from newly connected input devices.

Monitoring Recommendations

Collect kernel ring buffer logs centrally and alert on iforce-related warnings, oops traces, or KASAN reports.
Monitor USB device connection events on servers, kiosks, and endpoints where new peripheral attachment is unusual.
Track kernel version inventory across the fleet to identify hosts running builds that predate the referenced stable commits.

How to Mitigate CVE-2026-64273

Immediate Actions Required

Update to a Linux kernel version that includes one of the referenced stable fix commits, such as e5fa31f0, 0e9943d2, or 6c0f2901, matching your kernel branch.
Restrict physical access to systems exposing USB or serio ports, particularly on servers, kiosks, and shared workstations.
If the iforce driver is not needed, blocklist the module to remove the vulnerable code path from the attack surface.

Patch Information

The fix bounds the device-reported effect index against the compile-time array dimension IFORCE_EFFECTS_MAX rather than the runtime dev->ff->max_effects, guaranteeing memory safety regardless of how many effects the device registered. Stable trees have received backports; consult the kernel.org stable commit list for the branch matching your deployment. Distribution vendors typically ship the fix in their next kernel security update.

Workarounds

Blocklist the iforce kernel module using /etc/modprobe.d/ configuration on systems that do not require force-feedback joystick support.
Deploy USB device control policies (for example, USBGuard) to restrict which USB devices may attach to production hosts.
Disable serio ports in BIOS or via kernel parameters on systems that have no legacy input device requirement.

bash

# Blocklist the iforce module to remove the vulnerable code path
echo "blacklist iforce" | sudo tee /etc/modprobe.d/blacklist-iforce.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep iforce