CVE-2026-74683: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74683 Overview

CVE-2026-74683 is a Linux kernel vulnerability in the evdev input subsystem. The user-supplied event type index passed through the EVIOCGMASK and EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and the client evmasks array in evdev_get_mask(). While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict the bounds check and perform out-of-bounds loads. The upstream fix sanitizes the index branchlessly using array_index_mask_nospec(), clamping speculative access to safe values.

Critical Impact
A local user with access to an evdev character device can trigger speculative out-of-bounds reads through crafted ioctl calls, potentially leaking adjacent kernel memory via side-channel analysis.

Affected Products

Linux kernel — mainline evdev input driver prior to the referenced fix commits
Linux stable branches receiving backports across the eight referenced patch commits
Distributions shipping unpatched kernels with the affected drivers/input/evdev.c code

Discovery Timeline

2026-08-22 - CVE-2026-74683 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74683

Vulnerability Analysis

The vulnerability resides in the Linux kernel evdev character device driver, which exposes input events to user space. The EVIOCGMASK and EVIOCSMASK ioctls allow user-space callers to get or set per-event-type filter masks on an open evdev client. Both operations accept a user-controlled type field that identifies which event class (for example EV_KEY, EV_REL, EV_ABS) the mask applies to.

evdev_get_mask_cnt() uses this type value to index a static counts array, and evdev_get_mask() uses it to index the client evmasks array. A software bounds check against EV_CNT gates both accesses. On CPUs vulnerable to Spectre v1, the branch predictor can speculate past this check and perform loads at attacker-influenced offsets outside the intended array bounds.

Because the resulting speculative loads occur inside a privileged kernel context, values from adjacent kernel memory can transit micro-architectural caches. An attacker able to prime and probe cache state can then reconstruct those values, defeating kernel memory isolation.

Root Cause

The root cause is a missing speculative-execution barrier on a user-supplied array index. The architectural bounds check on type is correct, but nothing prevents the CPU from executing dependent loads before that check resolves. This is a classic bounds-check-bypass pattern that requires array_index_nospec() style masking rather than an ordinary conditional guard.

Attack Vector

Exploitation requires local access and the ability to open an evdev node under /dev/input/. A local attacker issues EVIOCGMASK or EVIOCSMASK ioctls with type values just outside the valid range, then uses a cache side channel to infer speculatively-loaded bytes from adjacent kernel memory. There is no verified public proof-of-concept for this specific CVE. Refer to the referenced kernel commits for the exact fix, including commit 3abd29c and commit f3fc329.

Detection Methods for CVE-2026-74683

Indicators of Compromise

No file-based indicators are published for this vulnerability. Detection focuses on abnormal ioctl activity against /dev/input/event* devices.
Unexpected local processes opening multiple evdev character devices and issuing repeated EVIOCGMASK or EVIOCSMASK calls with varying type arguments.

Detection Strategies

Audit ioctl() syscalls targeting /dev/input/event* file descriptors, filtering on the EVIOCGMASK (0x80104592) and EVIOCSMASK (0x40104593) request codes.
Correlate high-frequency evdev ioctl invocations with concurrent cache-timing workloads or perf_event_open usage from the same PID, which is a common Spectre v1 measurement pattern.
Track running kernel version against the patched commits in stable trees and alert on hosts still exposing the vulnerable drivers/input/evdev.c.

Monitoring Recommendations

Enable Linux audit rules on ioctl syscalls for input device paths and forward events to a central SIEM for baselining.
Monitor kernel version drift across the fleet and flag any host whose running kernel predates the fix commits referenced by this CVE.
Alert on unprivileged users obtaining read access to /dev/input/event* outside of expected desktop or accessibility sessions.

How to Mitigate CVE-2026-74683

Immediate Actions Required

Update to a Linux kernel release that includes the referenced fix commits, and reboot affected hosts to activate the new kernel.
Inventory systems that expose /dev/input/event* to non-root users, particularly multi-user servers, shared workstations, and container hosts that pass input devices through.
Verify that CPU-level Spectre v1 mitigations are enabled and not overridden by boot parameters such as mitigations=off or nospectre_v1.

Patch Information

The fix sanitizes the event type index in evdev_get_mask_cnt() using array_index_mask_nospec(), which branchlessly clamps out-of-range indices to zero and forces the returned count and derived xfer_size to zero on the speculative path. This prevents any speculative memory access to the client evmasks array in evdev_get_mask(). Backports are available across the stable trees. See commit 4034ef2, commit 433913b, commit 5db3411, commit 810e188, commit c79b08d, and commit f27fa9b.

Workarounds

Restrict read/write access to /dev/input/event* to trusted users and services via udev rules and group membership, reducing the local attack surface.
Keep architectural Spectre v1 mitigations enabled and avoid boot flags that disable speculative-execution defenses on shared or multi-tenant systems.
Where feasible, block untrusted local code execution using seccomp filters that deny the ioctl syscall on evdev file descriptors for sandboxed workloads.

bash

# Verify running kernel and Spectre v1 mitigation status
uname -r
cat /sys/devices/system/cpu/vulnerabilities/spectre_v1

# Restrict evdev access via udev (example)
# /etc/udev/rules.d/99-evdev-restrict.rules
# KERNEL=="event*", SUBSYSTEM=="input", MODE="0600", GROUP="input"
udevadm control --reload-rules && udevadm trigger