The Linux kernel evdev IOCTL handler copies user‑supplied data into an on‑stack struct without initializing the rest of the structure, allowing an attacker to pass a size smaller than the struct and cause stale kernel stack bytes to be stored in the device’s absinfo array. When the device is later read back, these stale bytes are returned to userspace, revealing memory that may contain secrets or other confidential data. This flaw results in information disclosure and is an instance of CWE‑908 weakness.

The issue originates in the generic evdev subsystem present in all mainstream Linux kernel releases that have not applied the patch to zero the input_absinfo structure before copying. The vendor/product names are Linux:Linux, and the CPE indicates the entire kernel. The specific affected versions are not enumerated in the advisory, implying that any unpatched kernel built from source is vulnerable until the fix is deployed.

The CVSS score of 7.0 is reported, indicating high severity. The EPSS score is < 1 %, indicating a very low probability of exploitation. The vulnerability is not catalogued in CISA KEV. Based on the description, the likely attack vector is local: any user with permission to access an evdev device can invoke the buggy EVIOCSABS ioctl and subsequently read the corrupted absinfo array via EVIOCGABS. Because the flaw does not provide code execution or privilege escalation, the overall risk is moderate, with a primary threat to confidentiality.