Executive brief
The Linux kernel's input event device (evdev) driver leaks uninitialized kernel memory to user-space applications through padding bytes in event structures. Applications reading input events can retrieve sensitive information that was previously stored in kernel memory, potentially exposing cryptographic keys, passwords, or other secrets handled by the kernel.
Technical details
The vulnerability is an information disclosure flaw in the evdev input driver's evdev_pass_values(), __evdev_queue_syn_dropped(), and __pass_event() functions. These functions allocate input_event structures on the kernel stack and populate them field-by-field, but do not initialize padding bytes (which exist on architectures like SPARC64). When these structures are copied to user-space via client buffers, the uninitialized padding leaks kernel stack memory. The fix uses explicit memset() to zero the entire structure before populating fields, ensuring all padding is cleared before crossing the user/kernel boundary. Patches have been applied across all stable kernel series.
Affected products
- Linux Linux kernel 2.6.11 and later (all versions prior to patching)
Timeline
- 2026-08-22: disclosed
- 2026-07-29: patched: Upstream fix committed; backported to stable branches by 2026-08-19