Use of Uninitialized Variable in Linux kernel - CVE-2026-90197

Vulnerability identifier: #VU151287

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-90197

CWE-ID: CWE-457

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause unintended values to be serialized into an HID effect report.

The vulnerability exists due to use of an uninitialized variable in the fill_effect_buf() function of the HID haptic driver when processing an effect containing an unhandled haptic usage. A local user can trigger processing of an effect containing an unhandled haptic usage to cause unintended values to be serialized into an HID effect report.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/2d92c250815cba6bffd64f0125fac7afe4fa6ce0
• https://git.kernel.org/stable/c/324cc98b71f0d3dee7367ef3c669fd80747e71b6
• https://git.kernel.org/stable/c/3efb7f6491526f5012f9ec94769e9ed832feeef8

• Use of Uninitialized Variable in Linux kernel hid driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more