CVE-2025-40035

An information disclosure flaw was found in the Linux kernel's uinput driver in the force feedback upload handling for 32-bit compatibility mode. A local user can trigger this issue by performing force feedback upload operations through the uinput device, where uninitialized padding bytes in the uinput_ff_upload_compat structure are copied to userspace. This leaks kernel stack memory contents to unprivileged users.

The uinput driver provides a userspace interface for creating virtual input devices with force feedback support. When handling FF_UPLOAD requests in 32-bit compatibility mode, the driver constructs a uinput_ff_upload_compat structure on the stack. This structure embeds ff_effect_compat twice, which contains internal padding bytes for alignment (notably after struct ff_replay before a union member). The code populates the valid fields but leaves padding uninitialized. When copy_to_user() transfers the entire structure, these padding bytes expose whatever stack data happened to occupy that memory. While the leaked data is limited in size and content is unpredictable, it could potentially reveal kernel pointers or other sensitive information useful for defeating KASLR or further exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the uinput module from being loaded if virtual input devices are not required. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.