A flaw in the Linux kernel’s evdev subsystem causes the input_event structure, which is allocated on the kernel stack and not fully initialized, to contain uninitialized padding bytes. When this structure is passed to client buffers and eventually copied to userspace, those padding bytes leak kernel stack memory and potentially sensitive data. The resulting vulnerability enables an attacker to read confidential information from kernel space, compromising confidentiality. The weakness pertains to improper initialization of memory structures.

The issue affects the Linux kernel on all architectures where struct input_event contains explicit or implicit padding, such as SPARC64. Any distribution or deployment that has not applied the fix—identified by the patch commits linked in the references—remains vulnerable. No specific kernel versions are listed in the CVE data, so all affected builds prior to the patch are impacted.

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to userspace processes that can read evdev device events, which typically implies local or compromised conditions. The likely attack vector is local, leveraging the evdev device interface, as inferred from the need for userspace processes to read evdev events. Thus, the risk is moderate for systems that expose input devices to untrusted processes or users. The kernel patch merely zeroes the event structure to eliminate the information leak, mitigating the vulnerability.