SB2026082490 - Out-of-bounds read in Linux kernel input driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082490

SB2026082490 - Out-of-bounds read in Linux kernel input driver

Published: August 24, 2026

Security Bulletin ID SB2026082490
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Out-of-bounds read (CVE-ID: CVE-2026-74683)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in evdev_get_mask_cnt() when handling EVIOCGMASK or EVIOCSMASK ioctl requests with a user-supplied event type index. A local user can supply a crafted event type index to disclose sensitive information.

The issue arises from speculative execution mispredicting bounds checks during access to the static counts array and can affect subsequent mask handling logic.


Remediation

Install update from vendor's website.

References