The Linux kernel evdev subsystem used a user-supplied event type index in EVIOCGMASK and EVIOCSMASK ioctls to index arrays without sufficient speculative execution protections. Although the event type index is architecturally bounded by EV_CNT, speculative execution could mispredict bounds checks and perform out-of-bounds loads. The vulnerability was mitigated by applying a branchless sanitization using array_index_mask_nospec() in evdev_get_mask_cnt(), which clamps out-of-bounds indices to zero and forces the count to zero speculatively, preventing speculative memory access to client evmasks arrays.

This vulnerability could allow speculative execution to access memory out-of-bounds when processing input event masks, potentially exposing sensitive kernel memory contents. However, no known exploits in the wild have been reported. The impact is limited to speculative execution side effects rather than direct memory corruption or privilege escalation.

A fix has been implemented in the Linux kernel by sanitizing the event type index in evdev_get_mask_cnt() using array_index_mask_nospec(). Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update or patch from the vendor or distribution is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; users should consult their Linux distribution or vendor advisory for the exact fixed versions and update accordingly.