UBUNTU-CVE-2026-90197: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages filleffectbuf() initializes value only for the four haptic usages handled by its switch, but writes it to field->value[] for every usage. An unhandled usage can therefore receive either an uninitialized value or one left over from the previous usage. hidoutputreport() then serializes that value into the effect's report buffer. Skip unhandled usages instead. This also matches switchmode(), which only updates fields it recognizes. Found with Clang's -Wconditional-uninitialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update fill_effect_buf() to skip unhandled HID usages instead of writing the uninitialized value to field->value[]; only update fields recognized by its switch.