CVE-2026-74683: Input: evdev - sanitize event type index when fetching event masks
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - sanitize event type index when fetching event masks
The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt() and client evmasks array in evdevgetmask().
While the event type is architecturally bounded by EVCNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.
Sanitize the event type index in evdevgetmaskcnt() branchlessly using arrayindexmasknospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.
We do not need additional arrayindexnospec() calls in evdevgetmask() because evdevgetmaskcnt() speculatively forces the count (and resulting xfersize) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What access would an attacker need to exercise the vulnerable code path?
The attacker would need to be able to issue the EVIOCGMASK or EVIOCSMASK ioctls with a user-controlled event type index.
Does the mitigation need separate bounds hardening for the client event-mask array?
No. The fix makes an out-of-range event type produce a speculative mask count of zero, resulting in a zero transfer size and preventing speculative access to the client evmasks array.