CVE-2026-74683: Linux kernel · Input: evdev – sanitize event type index when fetching event masks
Affects Linux kernelSource GCVE Database
Not known to be exploited · fixed in 5.15.0-1117.124~20.04.1 : update Linux kernel when convenient.
Data as of 28 Oct 2026, 01:00 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Patch
- Available – fixed in 5.15.0-1117.124~20.04.1, 5.15.0-1123.132~20.04.1, 5.15.0-1122.131~20.04.1 +27
Exploitation evidence
Disclosed: evidence found.
CVE published 22 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask(). While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads. Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds. We do not need additional array_index_nospec() calls in evdev_get_mask() because evdev_get_mask_cnt() speculatively forces the count (and resulting xfer_size) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.
References
- ubuntu.com/security/CVE-2026-74683 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-74683 (opens in a new tab)
- git.kernel.org/stable/c/f27fa9b39f925d26e034a1f382cb45523138f4ae (opens in a new tab)
- git.kernel.org/stable/c/c79b08d8fa230871a3634e34a66e591ac2d084ef (opens in a new tab)
- git.kernel.org/stable/c/f3fc329acad9a71b3c077237cbac20670d2358c8 (opens in a new tab)
- git.kernel.org/stable/c/433913b4a92214d76e9f0c03ad9128fec943d5f8 (opens in a new tab)
- git.kernel.org/stable/c/3abd29c61d2ef37c4102cf755b18be53bb9dbea6 (opens in a new tab)
- git.kernel.org/stable/c/5db341189bb7ff041d570dbe36ecca7e32913927 (opens in a new tab)
- git.kernel.org/stable/c/4034ef247a9dde3f56660b01f0c3280dac6b1274 (opens in a new tab)
- git.kernel.org/stable/c/810e1883d4815f29c30d900ad7333d03cc2515d1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8878-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8879-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8877-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8875-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8875-2 (opens in a new tab)