CVE-2026-90197: HID: haptic: don't write an uninitialized value to unhandled usages
In the Linux kernel, the following vulnerability has been resolved:
HID: haptic: don't write an uninitialized value to unhandled usages
filleffectbuf() initializes value only for the four haptic usages handled by its switch, but writes it to field->value[] for every usage. An unhandled usage can therefore receive either an uninitialized value or one left over from the previous usage. hidoutputreport() then serializes that value into the effect's report buffer.
Skip unhandled usages instead. This also matches switchmode(), which only updates fields it recognizes.
Found with Clang's -Wconditional-uninitialized.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel HID haptic driver are exposed when it processes an effect report containing usages that the driver does not handle. The issue occurs during construction of the haptic effect report sent through hid_output_report().
What condition triggers the incorrect write?
The affected code initializes the value only for four haptic usages, but previously wrote a value for every usage in the field. An unhandled usage could therefore receive an uninitialized value or a value retained from processing an earlier usage.
What does the fix change?
The fix skips unhandled usages rather than writing a value for them. This aligns the behavior with switch_mode(), which updates only recognized fields.