Riskcovery

CVE-2026-90197

HID: haptic: don't write an uninitialized value to unhandled usages

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: haptic: don't write an uninitialized value to unhandled usages

fill_effect_buf() initializes value only for the four haptic usages handled by its switch, but writes it to field->value[] for every usage. An unhandled usage can therefore receive either an uninitialized value or one left over from the previous usage. hid_output_report() then serializes that value into the effect's report buffer.

Skip unhandled usages instead. This also matches switch_mode(), which only updates fields it recognizes.

Found with Clang's -Wconditional-uninitialized.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 344ff358495706abc7aac1e0c59a5bb16b350307 to before 324cc98b71f0d3dee7367ef3c669fd80747e71b6Affected
  • 344ff358495706abc7aac1e0c59a5bb16b350307 to before 2d92c250815cba6bffd64f0125fac7afe4fa6ce0Affected
  • 344ff358495706abc7aac1e0c59a5bb16b350307 to before 3efb7f6491526f5012f9ec94769e9ed832feeef8Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.