CVE-2026-98201

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: zero ff_effect before compat copy in input_ff_effect_from_user

In the compat path input_ff_effect_from_user() aliases the caller's

native struct ff_effect with the smaller struct ff_effect_compat and

copies only the compat sized prefix:

compat_effect = (struct ff_effect_compat *)effect;

if (copy_from_user(compat_effect, buffer,

sizeof(struct ff_effect_compat)))

The tail of the native structure is never written. Callers pass an

uninitialized on-stack object, for example evdev_do_ioctl() for

EVIOCSFF, so those bytes keep their previous stack contents.

input_ff_upload() then stores the full native structure in

ff->effects[id], from where a uinput based force feedback daemon can

read it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to

userspace.

Zero the effect before the compat copy.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References