Executive brief
The Linux kernel's input event device handler (evdev) processes device events like keyboard and mouse input. A flaw in bounds checking on the event type parameter could allow speculative execution to read memory outside the intended array bounds, potentially exposing kernel memory to unprivileged local users.
Technical details
This is a Spectre v1 style vulnerability in the evdev input subsystem. When user-supplied event type indices are passed to EVIOCGMASK / EVIOCSMASK ioctls, they are used to index static arrays in evdev_get_mask_cnt() and evdev_get_mask(). Although the index is architecturally bounded by EV_CNT, speculative execution can mispredict the bounds check and perform out-of-bounds loads before the bounds check is resolved. The fix uses array_index_mask_nospec() to sanitize the index branchlessly, clamping out-of-bounds accesses to 0 and forcing speculative results to be discarded. Local network/device access is required to trigger this via ioctl calls on evdev file descriptors.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 3abd29c61d2ef37c4102cf755b18be53bb9dbea6
Timeline
- 2026-08-22: disclosed
- 2026-08-05: patched