CVE-2026-90197HID: haptic: don't write an uninitialized value to unhandled usages
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages fill_effect_buf() initializes value only for the four haptic usages handled by its switch, but writes it to field->value[] for every usage. An unhandled usage can therefore receive either an uninitialized value or one left over from the previous usage. hid_output_report() then serializes that value into the effect's report buffer. Skip unhandled usages instead. This also matches switch_mode(), which only updates fields it recognizes. Found with Clang's -Wconditional-uninitialized.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 344ff358495706abc7aac1e0c59a5bb16b350307 builds before 324cc98b71f0d3dee7367ef3c669fd80747e71b6; 344ff358495706abc7aac1e0c59a5bb16b350307 builds before 2d92c250815cba6bffd64f0125fac7afe4fa6ce0; 344ff358495706abc7aac1e0c59a5bb16b350307 builds before 3efb7f6491526f5012f9ec94769e9ed832feeef8 | CNA record |
References
- https://git.kernel.org/stable/c/324cc98b71f0d3dee7367ef3c669fd80747e71b6
- https://git.kernel.org/stable/c/2d92c250815cba6bffd64f0125fac7afe4fa6ce0
- https://git.kernel.org/stable/c/3efb7f6491526f5012f9ec94769e9ed832feeef8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.