# CVE-2026-80772: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

> A malicious or spoofed Nintendo controller can trigger an out-of-bounds read in the Linux kernel HID driver, leaking internal memory to userspace.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 4 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-99672, BELL-CVE-2026-80772, DEBIAN-CVE-2026-80772, GHSA-4hx6-rx69-cj3h, UBUNTU-CVE-2026-80772

## What is CVE-2026-80772?

CVE-2026-80772 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

joycon_ctlr_read_handler() casts an incoming HID input report to
struct joycon_input_report and parses it, guarding the cast only with a
12-byte length check:

	if (size >= 12) /* make sure it contains the input report */
		joycon_parse_report(ctlr, (struct joycon_input_report *)data);

struct joycon_input_report is 49 bytes: a 13-byte header followed by a
union whose IMU arm is 36 bytes. For an IMU report joycon_parse_report()
-> joycon_parse_imu_report() walks that union (struct offsets 13..48),
so a report of exactly 12 bytes with data[0] == JC_INPUT_IMU_DATA passes
the guard yet is read up to 37 bytes past its declared length. The
over-read bytes are decoded into accelerometer/gyroscope values and
forwarded to userspace through the "(IMU)" input device, leaking
driver-internal memory. data[0] and size are fully controlled by a
malicious or spoofed Joy-Con/Pro Controller.

Receive buffers are sized to the maximum report length, so this is an
over-read within the allocation rather than a slab OOB, but the decoded
bytes still reach userspace.

The sibling subcmd path in joycon_ctlr_handle_event() already bounds the
same cast correctly:

	if (size < sizeof(struct joycon_input_report) ||
	    data[0] != JC_INPUT_SUBCMD_REPLY)
		break;

Use the same sizeof(struct joycon_input_report) bound here.

## Which versions are affected by CVE-2026-80772?


## How do I fix CVE-2026-80772?

Apply the vendor's patch.

## Is CVE-2026-80772 being exploited?

There is no known exploitation of CVE-2026-80772 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80772 and fix it if it is affected.

What it is: CVE-2026-80772 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-80772 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80772/ (Markdown: https://insights.sbomify.com/CVE-2026-80772/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80772
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80772
- OSV: https://osv.dev/vulnerability/CVE-2026-80772

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80772/
Summaries are generated and may contain mistakes; the official description above is the record.