CVE-2026-74683
Received Received - Intake

Bounds Check Bypass in Linux Kernel evdev

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask(). While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads. Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds. We do not need additional array_index_nospec() calls in evdev_get_mask() because evdev_get_mask_cnt() speculatively forces the count (and resulting xfer_size) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74683
EUVD
EUVD-2026-64370

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a speculative execution vulnerability in the Linux kernel's evdev subsystem. It involves improper bounds checking when handling event type indices in EVIOCGMASK / EVIOCSMASK ioctls. The kernel fails to properly sanitize user-supplied indices, allowing potential out-of-bounds memory access through speculative execution misprediction. The fix uses array_index_mask_nospec() to clamp indices and prevent speculative out-of-bounds loads.

Detection Guidance

This vulnerability is specific to the Linux kernel's evdev subsystem and requires kernel-level detection. There are no direct network or system commands to detect it as it involves speculative execution and bounds checking in the kernel. Monitoring kernel logs for unusual events or crashes related to input device handling may indicate exploitation attempts.

Impact Analysis

This vulnerability could potentially allow local attackers to read or write kernel memory by exploiting speculative execution. On affected systems, it might enable privilege escalation, information disclosure, or denial of service. Users should update their Linux kernel to a patched version to mitigate this risk.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this vulnerability. This vulnerability is resolved in newer kernel versions, so applying the latest stable kernel update is the primary mitigation step.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart