CVE-2026-80772: Linux Kernel HID Nintendo Information Leak

CVE-2026-80772 Overview

CVE-2026-80772 is an out-of-bounds read vulnerability in the Linux kernel's HID Nintendo driver, specifically in the joycon_ctlr_read_handler() function. The driver casts an incoming HID input report to struct joycon_input_report after only verifying that the buffer is at least 12 bytes long. Because the structure is 49 bytes and IMU parsing walks offsets 13 through 48, a crafted 12-byte report with data[0] == JC_INPUT_IMU_DATA triggers a read up to 37 bytes past the declared length. The over-read bytes are decoded as accelerometer and gyroscope values and pushed to userspace through the IMU input device, leaking driver-internal memory to any attacker able to present a spoofed Joy-Con or Pro Controller.

Critical Impact
A malicious or spoofed Nintendo Joy-Con / Pro Controller can leak kernel driver memory to userspace via forged HID IMU reports.

Affected Products

Linux kernel branches containing the hid-nintendo driver prior to the fix commits
Distributions shipping the HID Nintendo Joy-Con / Pro Controller driver
Systems exposing HID input over USB or Bluetooth where an attacker can present a spoofed controller

Discovery Timeline

2026-09-04 - CVE-2026-80772 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80772

Vulnerability Analysis

The defect is an out-of-bounds read within an allocated receive buffer. joycon_ctlr_read_handler() accepts a raw HID input report and casts the byte array data to a struct joycon_input_report pointer. The only length precondition is size >= 12. The structure, however, is 49 bytes: a 13-byte header followed by a union whose IMU arm occupies 36 bytes.

When data[0] equals JC_INPUT_IMU_DATA, control flows through joycon_parse_report() into joycon_parse_imu_report(), which reads offsets 13 through 48. A report of exactly 12 bytes satisfies the guard but causes the parser to read up to 37 bytes past the reported length. Those bytes are decoded into accelerometer and gyroscope samples and emitted through the IMU input device, exposing adjacent driver-internal memory to userspace.

Because receive buffers are pre-sized to the maximum report length, the read stays inside the slab allocation and does not corrupt the allocator. The information disclosure to userspace still occurs.

Root Cause

The root cause is an insufficient length check preceding a structure cast. The sibling function joycon_ctlr_handle_event() correctly bounds the identical cast with size < sizeof(struct joycon_input_report). The read handler omits this check, permitting the parser to consume undefined bytes beyond the caller-supplied report length. Both data[0] and size are fully attacker-controlled.

Attack Vector

An attacker connects a spoofed or malicious Joy-Con / Pro Controller over USB or Bluetooth and transmits a crafted 12-byte HID input report whose first byte matches JC_INPUT_IMU_DATA. The driver forwards decoded values, containing leaked memory, to userspace as IMU sensor samples. Refer to the upstream fix commits including Kernel Git Commit 27b376b and Kernel Git Commit d4cabd4 for the corrected bounds check.

Detection Methods for CVE-2026-80772

Indicators of Compromise

Unexpected connection of HID devices identifying as Nintendo Joy-Con or Pro Controller on servers, workstations, or kiosks that do not normally use them.
Anomalously short HID input reports (near the 12-byte minimum) delivered by devices claiming the Joy-Con product identifiers.
Userspace processes reading /dev/input/event* nodes bound to hid-nintendo IMU devices on non-gaming systems.

Detection Strategies

Audit loaded kernel modules for hid-nintendo on hosts where the driver is not required, and alert on module load events.
Monitor udev events for new HID device attachments matching Nintendo vendor identifier 0x057e and unusual product IDs.
Track kernel version and patch state across the fleet to identify hosts still running vulnerable hid-nintendo builds.

Monitoring Recommendations

Instrument endpoint telemetry to log USB and Bluetooth HID device enumeration with vendor and product identifiers.
Capture kernel ring buffer messages from the hid-nintendo driver during controller probe and input handling for later review.
Correlate new input device creation with process access patterns to surface unexpected consumers of IMU event nodes.

How to Mitigate CVE-2026-80772

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable git commits and rebuild or update to a fixed kernel package from your distribution.
Unload the hid-nintendo module on systems that do not require Joy-Con or Pro Controller support using modprobe -r hid-nintendo.
Restrict physical and wireless access to trusted HID peripherals on servers and shared workstations.

Patch Information

The fix replaces the 12-byte length guard with size < sizeof(struct joycon_input_report), matching the bound already used in joycon_ctlr_handle_event(). Patches are available in multiple stable branches via Kernel Git Commit 27b376b, Kernel Git Commit 33ea29f, Kernel Git Commit 34725ed, Kernel Git Commit 51cfd1a, Kernel Git Commit addca61, Kernel Git Commit bd397c4, and Kernel Git Commit d4cabd4.

Workarounds

Blacklist the hid-nintendo module in /etc/modprobe.d/ on systems that do not need Nintendo controller support.
Enforce USB device allow-listing through usbguard or equivalent controls to block unapproved HID vendor and product identifiers.
Disable Bluetooth HID pairing on servers, VDI hosts, and other systems where game controllers should never appear.

bash

# Blacklist the hid-nintendo module and prevent auto-load
echo 'blacklist hid-nintendo' | sudo tee /etc/modprobe.d/blacklist-hid-nintendo.conf
echo 'install hid-nintendo /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-hid-nintendo.conf
sudo modprobe -r hid-nintendo
sudo update-initramfs -u