CVE-2026-74683 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - sanitize event type index when fetching event masks
The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask().
While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.
Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.
We do not need additional array_index_nospec() calls in evdev_get_mask() because evdev_get_mask_cnt() speculatively forces the count (and resulting xfer_size) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel input subsystem contains a vulnerability within the event device driver that allows for potential information disclosure through side-channel attacks. Specifically, the ioctls EVIOCGMASK and EVIOCSMASK are designed to retrieve or set masks of supported events for an input device. These interfaces accept an event type index from user space, which is subsequently used as an offset into two critical kernel data structures: a static counts array accessed via evdev_get_mask_cnt() and the client-specific event mask arrays accessed via evdev_get_mask(). The architectural constraint on valid event types is defined by EV_CNT, yet the implementation relies on standard bounds checking mechanisms that are susceptible to speculative execution vulnerabilities.
The core technical flaw lies in how modern CPU architectures handle branch prediction during these checks. While the code includes logic to verify if the provided index exceeds the maximum allowed value of EV_CNT, high-performance processors may speculatively execute instructions before the outcome of a conditional branch is fully resolved. If the processor mispredicts that the bounds check will pass, it proceeds with memory accesses using the user-supplied index even when that index is out of bounds. This speculative execution can result in loading data from kernel memory locations outside the intended array boundaries into CPU caches or registers without immediately triggering a fault if the subsequent architectural check fails and rolls back the state changes.
This behavior creates a classic Spectre-style side-channel attack vector, specifically aligning with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. An attacker who can invoke these ioctls repeatedly may be able to measure cache access times or utilize other microarchitectural leakage channels to infer the contents of kernel memory that were loaded speculatively during out-of-bounds accesses. Although the architectural state is correctly rolled back, the transient execution effects remain observable through timing analysis, potentially allowing an unprivileged local user to read sensitive kernel data structures and compromise system confidentiality.
The mitigation implemented involves sanitizing the event type index within evdev_get_mask_cnt() using a branchless technique provided by array_index_mask_nospec(). This function clamps any out-of-bounds index to zero for safe array access while ensuring that, during speculative execution, the returned count is forced to zero if the original index was invalid. By forcing the transfer size and subsequent counts to zero in the speculative path, the vulnerability prevents evdev_get_mask() from performing speculative memory accesses into the client evmasks array with malicious indices. This approach effectively neutralizes the side-channel leakage without requiring additional complex sanitization calls in downstream functions, as the root cause of the out-of-bounds speculation is addressed at the entry point where the index is first utilized for counting and sizing operations.
From a threat modeling perspective, this vulnerability falls under ATT&CK technique T1560: Layered Defense Bypass via Speculative Execution Side Channels, specifically leveraging transient execution to bypass memory isolation boundaries. The fix ensures that even if an attacker attempts to exploit the timing differences between valid and invalid array accesses, the speculative path no longer exposes sensitive kernel data because the index is neutralized before any meaningful memory load occurs in a way that could leak information. System administrators should apply the corresponding kernel update to mitigate this risk, as local privilege escalation or broader system compromise may be possible if combined with other vulnerabilities or used in conjunction with high-precision timing attacks against protected processes sharing the same CPU core.