SB20261007161 - Use of Uninitialized Variable in Linux kernel input driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261007161

SB20261007161 - Use of Uninitialized Variable in Linux kernel input driver

Published: October 7, 2026

Security Bulletin ID SB20261007161
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of Uninitialized Variable (CVE-ID: CVE-2026-98205)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized stack variable in the evdev_do_ioctl() function when processing EVIOCSABS ioctl requests with user-supplied sizes. A local user can submit an EVIOCSABS request with a short size and retrieve the resulting absolute axis information through EVIOCGABS to disclose sensitive information.

The disclosed data consists of stale kernel stack bytes left in the portion of the input_absinfo structure not supplied by the caller.


Remediation

Install update from vendor's website.

References