Use of Uninitialized Variable in Linux kernel - CVE-2026-98201
Published: October 7, 2026
Vulnerability identifier: #VU153822
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98201
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose kernel stack memory.
The vulnerability exists due to use of an uninitialized stack variable in input_ff_effect_from_user() when copying a smaller compatibility structure into the native struct ff_effect. A local user can submit a force feedback effect through EVIOCSFF and retrieve the stored native structure through UI_BEGIN_FF_UPLOAD to disclose kernel stack memory.
The readback path requires a uinput-based force feedback daemon.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98201
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0d05b43b55d4784a42ce8fb318175f8ad7d9af5a
- https://git.kernel.org/stable/c/6c26681c5668c973bd0e951407d670ac60d9cd66
- https://git.kernel.org/stable/c/b878720e8bcaa4cf7163a5081f904dd6baf11b2c
- https://git.kernel.org/stable/c/c5e573bb095d502be7cbbaa99c26a20984111c6d
- https://git.kernel.org/stable/c/ec174c2ab1abb76b20fa167c6db848c3d97aa838
- https://git.kernel.org/stable/c/ed0406e490f48ed180df140fe2a81be26bccb1a9
- https://git.kernel.org/stable/c/ed0905fda39682d3da7937184397d3276abbffa8
- https://git.kernel.org/stable/c/f84819ef8d66931ee3998fee3c4f03230f4cb6cc