Out-of-bounds read in Linux kernel - CVE-2026-74683
Published: August 24, 2026
Vulnerability identifier: #VU144672
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74683
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in evdev_get_mask_cnt() when handling EVIOCGMASK or EVIOCSMASK ioctl requests with a user-supplied event type index. A local user can supply a crafted event type index to disclose sensitive information.
The issue arises from speculative execution mispredicting bounds checks during access to the static counts array and can affect subsequent mask handling logic.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-74683
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.105-1
linux (Debian package) - update to 6.12.105-1
External References
- https://git.kernel.org/stable/c/3abd29c61d2ef37c4102cf755b18be53bb9dbea6
- https://git.kernel.org/stable/c/4034ef247a9dde3f56660b01f0c3280dac6b1274
- https://git.kernel.org/stable/c/433913b4a92214d76e9f0c03ad9128fec943d5f8
- https://git.kernel.org/stable/c/5db341189bb7ff041d570dbe36ecca7e32913927
- https://git.kernel.org/stable/c/810e1883d4815f29c30d900ad7333d03cc2515d1
- https://git.kernel.org/stable/c/c79b08d8fa230871a3634e34a66e591ac2d084ef
- https://git.kernel.org/stable/c/f27fa9b39f925d26e034a1f382cb45523138f4ae
- https://git.kernel.org/stable/c/f3fc329acad9a71b3c077237cbac20670d2358c8