SB2026091919 - Use of Uninitialized Variable in Linux kernel hid driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of Uninitialized Variable (CVE-ID: CVE-2026-90197)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended values to be serialized into an HID effect report.

The vulnerability exists due to use of an uninitialized variable in the fill_effect_buf() function of the HID haptic driver when processing an effect containing an unhandled haptic usage. A local user can trigger processing of an effect containing an unhandled haptic usage to cause unintended values to be serialized into an HID effect report.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2d92c250815cba6bffd64f0125fac7afe4fa6ce0
• https://git.kernel.org/stable/c/324cc98b71f0d3dee7367ef3c669fd80747e71b6
• https://git.kernel.org/stable/c/3efb7f6491526f5012f9ec94769e9ed832feeef8