Executive brief
The Linux kernel's HID haptic driver contained a bug where uninitialized or stale data could be written to haptic device configuration reports. The vulnerable fill_effect_buf() function would write whatever value was in memory for unhandled device types, rather than skipping them. While the reported severity is low, this could potentially result in incorrect haptic feedback behavior or unexpected device state.
Technical details
The vulnerability is an uninitialized variable usage in the drivers/hid/hid-haptic.c file. The fill_effect_buf() function initializes a variable only for four recognized haptic usage types within a switch statement, but unconditionally writes that variable to field->value[] for every usage, including unhandled ones. This means unhandled usages receive either uninitialized stack data or residual values from previous iterations. The hid_output_report() function then serializes these invalid values into the effect's report buffer sent to the device. The fix changes a `break` to `continue` in the default case, skipping unhandled usages entirely. The vulnerability was found using Clang's -Wconditional-uninitialized warning.
Affected products
- Linux Linux kernel 4.19 through 6.18 and later
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched