The vulnerability arises in the Linux kernel’s compat path for the function input_ff_effect_from_user. An uninitialized stack object is copied into a smaller structure, leaving the tail of the native struct ff_effect untouched. When the full structure is later stored and read back via UI_BEGIN_FF_UPLOAD, the leftover stack contents are exposed to a user‑space force‑feedback daemon, creating a direct disclosure of kernel memory to userspace.

All Linux kernel releases are affected until the security commit that zeroes the ff_effect structure before the compatible copy is applied. The issue spans every distribution and vendor that builds with the upstream kernel source.

The CVSS score is 7.0, indicating a high severity vulnerability. EPSS score is < 1% and the flaw is not listed in CISA’s KEV catalog. A likely attack vector requires a process that can issue the EVIOCSFF ioctl to configure a force‑feedback device; this capability is usually limited to privileged users or applications that interface with such devices. The resulting kernel data leakage could assist further attacks, but the overall risk is considered moderate pending a kernel update.