---
id: CVE-2026-74683
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Input: evdev - sanitize event type index when fetching event masks

  The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
  ioctls is used to index the sta…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Input: evdev - sanitize event type index when fetching event masks

  The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
  ioctls is used to index the sta…
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74683'
references:
  - url: 'https://git.kernel.org/stable/c/3abd29c61d2ef37c4102cf755b18be53bb9dbea6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4034ef247a9dde3f56660b01f0c3280dac6b1274'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/433913b4a92214d76e9f0c03ad9128fec943d5f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5db341189bb7ff041d570dbe36ecca7e32913927'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/810e1883d4815f29c30d900ad7333d03cc2515d1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c79b08d8fa230871a3634e34a66e591ac2d084ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f27fa9b39f925d26e034a1f382cb45523138f4ae'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f3fc329acad9a71b3c077237cbac20670d2358c8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0019
epssPercentile: 0.0804
ingestedAt: '2026-10-14T13:30:58.536Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - sanitize event type index when fetching event masks

The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
ioctls is used to index the static counts array in evdev_get_mask_cnt()
and client evmasks array in evdev_get_mask().

While the event type is architecturally bounded by EV_CNT, speculative
execution may mispredict bounds checks and perform out-of-bounds loads.

Sanitize the event type index in evdev_get_mask_cnt() branchlessly using
array_index_mask_nospec(). This clamps the index to 0 for safe array
access and forces the returned count to 0 speculatively when the index
is out of bounds.

We do not need additional array_index_nospec() calls in evdev_get_mask()
because evdev_get_mask_cnt() speculatively forces the count (and
resulting xfer_size) to 0 for out-of-bounds types, preventing any
speculative memory access to client evmasks array.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.