Use of Uninitialized Variable in Linux kernel - CVE-2026-90197
Published: September 19, 2026
Vulnerability identifier: #VU151287
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90197
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause unintended values to be serialized into an HID effect report.
The vulnerability exists due to use of an uninitialized variable in the fill_effect_buf() function of the HID haptic driver when processing an effect containing an unhandled haptic usage. A local user can trigger processing of an effect containing an unhandled haptic usage to cause unintended values to be serialized into an HID effect report.
Affected software
Linux kernel
How to mitigate CVE-2026-90197
Install security update from vendor's repository.