CVE-2026-74673: Linux Kernel Information Disclosure Vulnerability

CVE-2026-74673 Overview

CVE-2026-74673 is an information disclosure vulnerability in the Linux kernel's evdev input subsystem. The flaw exists in evdev_pass_values(), where the input_event structure is allocated on the kernel stack and populated field-by-field without full initialization. On architectures where struct input_event contains explicit or implicit padding, such as the 32-bit __pad field on SPARC64, those padding bytes retain prior kernel stack contents. When the event is copied to userspace through the client buffer, those uninitialized bytes leak kernel memory. Similar patterns exist in __evdev_queue_syn_dropped and __pass_event. The fix zeroes the entire event structure with memset() before field population.

Critical Impact
Local userspace processes reading from evdev character devices can receive uninitialized kernel stack bytes, exposing sensitive information that may aid subsequent kernel exploitation.

Affected Products

Linux kernel (input subsystem, drivers/input/evdev.c)
Architectures with padding in struct input_event, including SPARC64
Distributions shipping kernels prior to the fix commits referenced in stable trees

Discovery Timeline

2026-08-22 - CVE-2026-74673 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74673

Vulnerability Analysis

The vulnerability is an uninitialized memory disclosure in the Linux kernel input event delivery path. The evdev driver exposes /dev/input/eventX character devices that userspace reads to receive input events. Inside evdev_pass_values(), the kernel constructs an input_event on the stack by assigning individual fields such as type, code, and value, along with the timestamp fields.

When struct input_event contains compiler-inserted padding or explicit padding fields, field-by-field assignment does not touch the padding bytes. Those bytes retain whatever data the previous stack frame left behind, which may include pointers, credentials, or other kernel state. The populated event is then queued in the client buffer and later handed to userspace through read(), crossing the kernel-to-user trust boundary while carrying uninitialized data.

Root Cause

The root cause is missing initialization of a compound stack object before it is exported to userspace [CWE-908, CWE-200]. Compilers may add padding to satisfy alignment requirements, and architectures such as SPARC64 include an explicit __pad field in struct input_event. Field-by-field population reaches only the named members. The remaining bytes stay uninitialized. The same anti-pattern is present in __evdev_queue_syn_dropped and __pass_event.

Attack Vector

Exploitation is local. Any process with read access to an evdev device node, typically members of the input group or containers with input devices mapped in, can trigger event generation and read the resulting stream. Repeated reads yield successive slices of uninitialized stack memory. The leak is passive and does not require elevated privileges, but the value of the disclosed bytes depends on prior kernel stack activity. Attackers commonly chain such infoleaks with a separate memory corruption bug to defeat kernel address space layout randomization (KASLR) or to locate credential structures.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fix commits, including Kernel Git Commit 06a286b and Kernel Git Commit e748811, for the exact code paths.

Detection Methods for CVE-2026-74673

Indicators of Compromise

Unprivileged processes holding long-lived open file descriptors on /dev/input/event* nodes without a legitimate input use case.
Sustained high-volume read() activity against evdev devices from non-desktop or non-session workloads.
Containers or sandboxes with /dev/input bind-mounted contrary to policy.

Detection Strategies

Audit open() and read() syscalls targeting /dev/input/event* using auditd rules or eBPF-based syscall tracing.
Inventory running kernel versions against the fixed stable releases referenced in the upstream commits and flag hosts still on vulnerable builds.
Review udev rules and group membership for input to identify unexpected accounts with read access to event devices.

Monitoring Recommendations

Alert on non-graphical service accounts or daemons that open evdev devices.
Track kernel package versions across the fleet and correlate with the patch commits listed in the NVD references.
Log container runtime configurations that expose /dev/input to workloads.

How to Mitigate CVE-2026-74673

Immediate Actions Required

Apply the upstream stable kernel updates that include the memset() initialization fix for evdev_pass_values(), __evdev_queue_syn_dropped, and __pass_event.
Restrict membership of the input group and remove read access to /dev/input/event* from accounts that do not require it.
Remove /dev/input mappings from containers that do not need physical input access.

Patch Information

The issue is resolved by explicitly zeroing the input_event structure with memset() before populating its fields, which clears both compiler padding and explicit padding such as the SPARC64 __pad field. Fixes are available across multiple stable branches. Reference commits: 06a286b, 7d17e94, 7e55ca1, 90f305f, bd3c410, c6d5fa4, d2e3839, and e748811.

Workarounds

Tighten permissions on /dev/input/event* device nodes via udev rules so only trusted session users have read access.
Disable or unload evdev on systems that do not require userspace input event delivery.
Enforce seccomp or LSM policies that deny read() on evdev device files for service accounts.

bash

# Verify running kernel and udev permissions on evdev nodes
uname -r
ls -l /dev/input/event*
getent group input

# Example udev rule to restrict evdev access to the input group only
# /etc/udev/rules.d/99-evdev-restrict.rules
# KERNEL=="event*", SUBSYSTEM=="input", MODE="0640", GROUP="input"
udevadm control --reload
udevadm trigger --subsystem-match=input