Use of Uninitialized Variable in Linux kernel - CVE-2026-98205
Published: October 7, 2026
Vulnerability identifier: #VU153814
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98205
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use of an uninitialized stack variable in the evdev_do_ioctl() function when processing EVIOCSABS ioctl requests with user-supplied sizes. A local user can submit an EVIOCSABS request with a short size and retrieve the resulting absolute axis information through EVIOCGABS to disclose sensitive information.
The disclosed data consists of stale kernel stack bytes left in the portion of the input_absinfo structure not supplied by the caller.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98205
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/30b853a3d71f16bd0aa66b604bc37dd1254a19b3
- https://git.kernel.org/stable/c/3dfe48d5307a1ba22c58231d04257737015569ca
- https://git.kernel.org/stable/c/71e5619db11dd6429101bd967230d0321ec5ea26
- https://git.kernel.org/stable/c/89b6ffa4bc10c436fa9aecc73be105124cd58a35
- https://git.kernel.org/stable/c/8b852965b8eaf910c314dc346967ed82c8d4f235
- https://git.kernel.org/stable/c/af5f7130cbf39e6e12336d0b7a5f6e76e4e1526b
- https://git.kernel.org/stable/c/c0aebb57b73c7d06ad21731099afe119b113c403
- https://git.kernel.org/stable/c/e834e134a32b6a5c600fa539bb49146f617743ab