CVE-2026-74673

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An information leak exists in the evdev component where the input event structure is allocated on the kernel stack but not fully initialized. On specific architectures, such as SPARC64, the structure contains padding bytes (e.g., the pad field) that remain uninitialized. When this structure is passed to the client buffer and copied to userspace, these padding bytes leak kernel stack memory, which may expose sensitive information. This issue affects the evdev pass values(), evdev queue syn dropped(), and pass event() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.