The Linux kernel evdev subsystem had a vulnerability (CVE-2026-74673) where the input_event structure was allocated on the kernel stack and populated field-by-field without fully initializing all bytes. On architectures with padding bytes in this structure, these padding bytes remained uninitialized and were leaked when the event was copied to userspace. This could result in an information leak of kernel stack memory. The fix involved using memset() to zero the entire structure before populating its fields, ensuring no uninitialized data is exposed.

The vulnerability could lead to an information leak of kernel stack memory contents to userspace processes, potentially exposing sensitive information from the kernel memory. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix is available that explicitly zeroes the input_event structure before use, preventing leakage of uninitialized kernel stack memory. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fix and updated kernel versions.