CVE-2026-80573: Linux Kernel iforce Buffer Overflow Flaw

CVE-2026-80573 Overview

CVE-2026-80573 is a vulnerability in the Linux kernel iforce input driver, which supports I-Force joystick and wheel force-feedback devices. The iforce_process_packet() function reads fixed fields from joystick, wheel, and status packets without validating packet lengths first. The shared hats-and-buttons helper unconditionally reads data[6], the status tail consumes incomplete 16-bit effect addresses, and a zero-length USB Universal Serial Bus Request Block (URB) triggers an out-of-bounds read of the packet ID before the common parser executes.

Critical Impact
A malicious or malformed USB input device can trigger out-of-bounds reads in the Linux kernel, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel iforce input driver (drivers/input/joystick/iforce)
Multiple upstream and stable Linux kernel branches (see backport commits)
Systems attaching I-Force compatible USB joysticks or wheels

Discovery Timeline

2026-08-26 - CVE-2026-80573 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80573

Vulnerability Analysis

The defect resides in iforce_process_packet() within the Linux kernel iforce joystick driver. The function dispatches on the packet identifier and parses joystick, wheel, and status frames using fixed field offsets. It does not verify that the received buffer is long enough to contain those fields before dereferencing them.

Three distinct out-of-bounds read conditions arise from the missing checks. First, the shared hats-and-buttons parser always reads byte data[6], even when the packet is shorter than seven bytes. Second, the status packet tail is parsed as a sequence of 16-bit effect addresses, but the loop consumes a final address even when only one trailing byte remains. Third, a successful zero-length USB URB completion still causes the driver to read the packet ID byte prior to invoking the common parser, reading uninitialized or adjacent memory.

The issue is an input validation error affecting kernel-mode packet parsing. Exploitation requires the ability to deliver crafted packets from an iforce-compatible device, typically via physical USB attachment or a malicious peripheral emulator.

Root Cause

The root cause is missing length validation before structured field access. Packet parsing routines trust the transport layer to supply well-sized buffers and rely on offsets like data[6] without bounds checks. The upstream fix rejects zero-length USB transfers, enforces a seven-byte prefix for joystick and wheel packets, requires a two-byte status prefix, and consumes only complete status-tail addresses.

Attack Vector

The attack vector is a physically or logically attached USB input device capable of returning truncated or zero-length packets on the interrupt endpoint. An attacker with the ability to plug in a malicious device or emulate one via a BadUSB-style implant can drive the driver into out-of-bounds reads within kernel memory. See the upstream fix commit for the corrected parser logic.

Detection Methods for CVE-2026-80573

Indicators of Compromise

Unexpected iforce driver messages, warnings, or KASAN out-of-bounds reports in dmesg or journalctl -k output
Attachment of unfamiliar USB HID or joystick class devices identifying with I-Force vendor and product IDs
Kernel oops or panic traces referencing iforce_process_packet in the call stack

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to surface out-of-bounds reads in iforce_process_packet() under fuzzed input
Monitor kernel logs for driver-emitted diagnostics from the iforce module and correlate with recent USB device connection events
Inventory endpoints and identify hosts still running unpatched kernels with the iforce driver enabled

Monitoring Recommendations

Aggregate kernel logs and USB device connection audit events into a centralized log store for correlation
Alert on new USB HID device insertions on servers, kiosks, and other systems where user peripherals are not expected
Track kernel package versions across the fleet and flag hosts lagging behind patched stable releases

How to Mitigate CVE-2026-80573

Immediate Actions Required

Update to a Linux kernel version that incorporates the iforce packet length validation fix from the referenced stable commits
If the iforce driver is not required, blacklist the module to remove the attack surface entirely
Restrict physical USB access on sensitive systems and enforce USB device authorization policies

Patch Information

The fix is available in multiple stable Linux kernel branches. Relevant commits include 0ec411167655, 2c083ab16e33, 5232529eaf57, 5751c781d3c9, 609be4098889, 84e5cb517f44, a64a8b6b31cd, and e73d7a7d913d. Apply distribution updates once vendor-signed kernels containing these commits are released.

Workarounds

Unload and blacklist the iforce kernel module on systems that do not use I-Force joysticks or wheels
Enforce USB device allow-listing through USBGuard or equivalent host-based controls to prevent untrusted peripherals from binding
Disable USB HID and joystick class access on servers and other systems without a legitimate need for input peripherals

bash

# Blacklist the iforce driver until a patched kernel is deployed
echo 'blacklist iforce' | sudo tee /etc/modprobe.d/blacklist-iforce.conf
sudo modprobe -r iforce 2>/dev/null || true
sudo update-initramfs -u