CVE-2026-90197

A flaw was found in the Linux kernel's Human Interface Device (HID) haptic subsystem. A local attacker could exploit a vulnerability in the fill_effect_buf() function, which incorrectly writes uninitialized or leftover memory values to the field->value[] array for unhandled haptic usages. This uninitialized data is subsequently serialized into the effect's report buffer by hid_output_report(). This vulnerability could lead to information disclosure, potentially exposing sensitive kernel memory contents.

A moderate-impact flaw was found in the Linux kernel's Human Interface Device (HID) haptic subsystem. The fill_effect_buf() function initializes a local value only for the four haptic usages handled by its switch statement, but it writes that value into field->value[] for every usage in the field. An unhandled usage can therefore receive either an uninitialized value or one left over from the previous usage, and hid_output_report() subsequently serializes that value into the haptic effect's output report. A local attacker able to submit haptic effect requests on a system with an affected HID haptic device could exploit this flaw to cause uninitialized or leftover kernel data to be written into the device's effect report buffer, which can lead to information disclosure of kernel memory contents or unintended device behavior. Red Hat has rated this flaw as moderate severity (CVSS:3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The Red Hat Enterprise Linux 10 kernel in the rhel-10.3 and rhel-10.4 streams, and the Red Hat In-Vehicle OS 2 kernel and kernel-ivos-qualcomm components in the rhivos-2.0.z, rhivos-2.0.z-core, rhivos-2.1, and rhivos-2.1-core streams, are affected. For these affected products the fix has been deferred to a future update; the residual risk is limited because exploitation requires local access to the system together with a connected HID haptic device that exposes usages the driver does not handle. Red Hat Enterprise Linux 6, 7, 8, and 9, the earlier Red Hat Enterprise Linux 10 streams (rhel-10.0.z and rhel-10.2.z) including kernel-rt, and the OpenShift Container Platform RHEL CoreOS components are not affected because the vulnerable code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.