CVE-2026-46232: HID: playstation: Clamp num_touch_reports

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's HID playstation driver, specifically in the DualShock 4 touch report parsing code. The flaw is reachable from an adjacent network or local bus context and requires no authentication, allowing a malicious or crafted USB/Bluetooth HID device to supply an oversized touch-report count. Successful exploitation leaks up to roughly 2 KiB of kernel memory contents via the evdev interface and can disrupt service availability. A patched-image rebuild at fix versions 6.6.140 and 6.12.90 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attack originates from an adjacent network or physical bus (Bluetooth or USB), meaning the attacker must be on the same LAN, VLAN, or within wireless/wired HID pairing range rather than reaching the target over the open internet.

• AuthenticationNot required

  No credentials or account are needed; the attacker only needs to present a crafted HID device to the target host.

• Victim interactionNot required

  No user action is required; parsing of the malicious touch report happens automatically when the kernel processes HID input from the device.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special memory layout requirements are needed beyond supplying an oversized num_touch_reports value.

Blast Radius

• Reads up to roughly 2 KiB of out-of-bounds kernel memory, which may include sensitive in-kernel data structures, and emits that data to userspace via the evdev interface.
• Disrupts normal operation of the affected kernel subsystem, which can crash or destabilize the HID input stack and cause a denial of service for input-dependent workloads.
• Integrity of processed input events is unaffected; the vulnerability does not grant write access to kernel memory.