CVE-2026-74673 (GCVE-0-2026-74673)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-25 05:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - fix information leak in evdev_pass_values()
In evdev_pass_values(), the input_event structure is allocated on the
kernel stack and populated field-by-field. However, it is never fully
initialized. On architectures where struct input_event contains explicit
or implicit padding (such as the 32-bit __pad field on SPARC64), these
padding bytes are left uninitialized.
When this event structure is subsequently passed to the client buffer
and later copied to userspace, the uninitialized padding bytes leak
kernel stack memory, potentially exposing sensitive information.
Similar issues exist in __evdev_queue_syn_dropped and __pass_event.
Fix this by explicitly zeroing the entire event structure with memset()
before populating its fields. This ensures all padding bytes are cleared
before the data crosses the security boundary.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/evdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2e3839419ac4047835762c4d7712bda1101b57e",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "c6d5fa46c1ee25d068fc730fd377f0f54188d290",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "e748811d9b80a3e101110ff4b3c612e5fca54d98",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "06a286b320236508d02ab2ccc9496352748652a8",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "bd3c4108a56de34380edab670065e86283cb3029",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "7e55ca1080f09d9f7112c7f20ac31f682c1f2374",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "90f305f2c7a30257c683e13f4bf7c798eea992a0",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/evdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - fix information leak in evdev_pass_values()\n\nIn evdev_pass_values(), the input_event structure is allocated on the\nkernel stack and populated field-by-field. However, it is never fully\ninitialized. On architectures where struct input_event contains explicit\nor implicit padding (such as the 32-bit __pad field on SPARC64), these\npadding bytes are left uninitialized.\n\nWhen this event structure is subsequently passed to the client buffer\nand later copied to userspace, the uninitialized padding bytes leak\nkernel stack memory, potentially exposing sensitive information.\n\nSimilar issues exist in __evdev_queue_syn_dropped and __pass_event.\n\nFix this by explicitly zeroing the entire event structure with memset()\nbefore populating its fields. This ensures all padding bytes are cleared\nbefore the data crosses the security boundary."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:23:15.607Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2e3839419ac4047835762c4d7712bda1101b57e"
},
{
"url": "https://git.kernel.org/stable/c/c6d5fa46c1ee25d068fc730fd377f0f54188d290"
},
{
"url": "https://git.kernel.org/stable/c/e748811d9b80a3e101110ff4b3c612e5fca54d98"
},
{
"url": "https://git.kernel.org/stable/c/06a286b320236508d02ab2ccc9496352748652a8"
},
{
"url": "https://git.kernel.org/stable/c/7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b"
},
{
"url": "https://git.kernel.org/stable/c/bd3c4108a56de34380edab670065e86283cb3029"
},
{
"url": "https://git.kernel.org/stable/c/7e55ca1080f09d9f7112c7f20ac31f682c1f2374"
},
{
"url": "https://git.kernel.org/stable/c/90f305f2c7a30257c683e13f4bf7c798eea992a0"
}
],
"title": "Input: evdev - fix information leak in evdev_pass_values()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74673",
"datePublished": "2026-08-22T15:32:42.941Z",
"dateReserved": "2026-08-15T05:44:03.925Z",
"dateUpdated": "2026-08-25T05:23:15.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…