An out-of-bounds memory write flaw was found in the Linux kernel's joystick
devices subsystem in versions before 5.9-rc1, in the way the user calls
ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or
possibly escalate their privileges on the system. The highest threat from
this vulnerability is to confidentiality, integrity, as well as system
availability.

Murray McAllister discovered that the joystick device interface in the
Linux kernel did not properly validate data passed via an ioctl(). A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code on systems with a joystick device
registered.