---
id: CVE-2026-90197
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: haptic: don't write an uninitialized value to unhandled usages

  fill_effect_buf() initializes value only for the four haptic usages
  handled by its switch, but writ…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  HID: haptic: don't write an uninitialized value to unhandled usages

  fill_effect_buf() initializes value only for the four haptic usages
  handled by its switch, but writ…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 344ff358495706abc7aac1e0c59a5bb16b350307 <
    324cc98b71f0d3dee7367ef3c669fd80747e71b6
  - >-
    Linux >= 344ff358495706abc7aac1e0c59a5bb16b350307 <
    2d92c250815cba6bffd64f0125fac7afe4fa6ce0
  - >-
    Linux >= 344ff358495706abc7aac1e0c59a5bb16b350307 <
    3efb7f6491526f5012f9ec94769e9ed832feeef8
  - Linux 6.18
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:14.530'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90197'
references:
  - url: 'https://git.kernel.org/stable/c/2d92c250815cba6bffd64f0125fac7afe4fa6ce0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/324cc98b71f0d3dee7367ef3c669fd80747e71b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3efb7f6491526f5012f9ec94769e9ed832feeef8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.863Z'
epss: 0.00198
epssPercentile: 0.09842
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

HID: haptic: don't write an uninitialized value to unhandled usages

fill_effect_buf() initializes value only for the four haptic usages
handled by its switch, but writes it to field->value[] for every usage.
An unhandled usage can therefore receive either an uninitialized value
or one left over from the previous usage. hid_output_report() then
serializes that value into the effect's report buffer.

Skip unhandled usages instead. This also matches switch_mode(), which
only updates fields it recognizes.

Found with Clang's -Wconditional-uninitialized.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.