CVE-2026-98201: Input: zero ff_effect before compat copy in input_ff_effect_from_user

Published Oct 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

Input: zero ffeffect before compat copy in inputffeffectfromuser

In the compat path inputffeffectfromuser() aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:

compateffect = (struct ffeffectcompat )effect;

if (copyfromuser(compateffect, buffer, sizeof(struct ffeffectcompat)))

The tail of the native structure is never written. Callers pass an uninitialized on-stack object, for example evdevdoioctl() for EVIOCSFF, so those bytes keep their previous stack contents. inputffupload() then stores the full native structure in ff->effects[id], from where a uinput based force feedback daemon can read it back via UIBEGINFFUPLOAD, disclosing kernel stack memory to userspace.

Zero the effect before the compat copy.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:44 AM

Data Sourced

via MITRE·08:44 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Frequently Asked Questions

Who can realistically access the leaked data?

A userspace force-feedback daemon using uinput can read the uninitialized bytes back through UI_BEGIN_FF_UPLOAD after a compatible force-feedback effect is uploaded. The issue is therefore relevant on systems where untrusted or less-trusted userspace can interact with input force-feedback and uinput interfaces.

What conditions are required to trigger the disclosure?

The affected path requires a compat ioctl request for EVIOCSFF, which copies a smaller compat ff_effect structure into a native structure whose remaining bytes were not initialized. The full native structure must then be stored and made available through the uinput force-feedback upload path.

Is this a memory disclosure or a memory-corruption issue?

This is a kernel stack information disclosure. Bytes in the native ff_effect structure that are not populated by the compat-sized copy can contain prior on-stack data and may be returned to userspace.

What is the remediation described by the fix?

Initialize the native ff_effect structure to zero before copying the compat structure from userspace. This ensures the native-structure tail cannot retain uninitialized kernel stack contents.

CVE-2026-98201: Input: zero ff_effect before compat copy in input_ff_effect_from_user

Affected Software

Event History

Frequently Asked Questions

Who can realistically access the leaked data?

What conditions are required to trigger the disclosure?

Is this a memory disclosure or a memory-corruption issue?

What is the remediation described by the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically access the leaked data?

What conditions are required to trigger the disclosure?

Is this a memory disclosure or a memory-corruption issue?

What is the remediation described by the fix?