CVE-2026-98201

Executive Summary

CVE-2026-98201 is an uninitialized kernel stack memory disclosure vulnerability in the Linux kernel input subsystem's force-feedback compat ioctl path. The function input_ff_effect_from_user() aliases the caller's native struct ff_effect with the smaller struct ff_effect_compat and copies only the compat-sized prefix, leaving the tail of the native structure uninitialized. Because callers such as evdev_do_ioctl() for EVIOCSFF pass an on-stack object, stale kernel stack bytes are retained and subsequently persisted by input_ff_upload() into ff->effects[id], from which a uinput-based force-feedback daemon can read the data back to userspace via UI_BEGIN_FF_UPLOAD. Any system running a compat-capable Linux kernel that exposes the evdev force-feedback interface is affected, with impact limited to confidentiality (kernel stack memory disclosure) as no code execution or integrity loss is demonstrated by the description.

Technical Analysis

The vulnerability resides in the compat ioctl translation layer for the Linux input force-feedback subsystem. On 64-bit kernels, 32-bit userspace processes issue ioctls that are serviced by compat variants of the native handlers. The description identifies input_ff_effect_from_user() as the vulnerable function. It is invoked from the compat path of evdev_do_ioctl() in response to an EVIOCSFF ioctl from a 32-bit caller.

The core defect is a structure-size mismatch. The native struct ff_effect is larger than struct ff_effect_compat. The function performs the following:

compat_effect = (struct ff_effect_compat *)effect;

if (copy_from_user(compat_effect, buffer,
                   sizeof(struct ff_effect_compat)))

Here effect points to a native struct ff_effect on the kernel stack, but only sizeof(struct ff_effect_compat) bytes are written by the copy_from_user(). The tail of the native structure — the bytes beyond the compat struct — is never initialized. The caller (evdev_do_ioctl() for EVIOCSFF) supplies an uninitialized on-stack object, so those trailing bytes retain whatever data previously occupied that kernel stack region.

After the copy, the full native struct ff_effect is passed onward. input_ff_upload() stores it in the per-device effect array ff->effects[id]. The uinput interface then exposes this stored structure through the UI_BEGIN_FF_UPLOAD operation. A userspace force-feedback daemon built on uinput can read back the full native structure, including the bytes that were never initialized — resulting in disclosure of kernel stack memory to an unprivileged local user.

This is a classic uninitialized-memory information leak (CWE-908) that escalates to sensitive information exposure (CWE-200). The attack surface is the compat ioctl path of the evdev driver with force-feedback support enabled (CONFIG_INPUT_FF_MEMLESS and CONFIG_COMPAT). The disclosure is bounded: it exfiltrates whatever was on the kernel stack at the time of the ioctl, not arbitrary kernel memory. There is no memory corruption, privilege boundary bypass, or code execution described.

Notably, no CVSS score, CWE mapping, or affected version range was published in the provided intelligence. The mechanism is nonetheless well-defined by the NVD description.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists, and the vendor patch status is unpatched with no tracked source. The attack chain is inferred from the vulnerability class (uninitialized kernel stack disclosure) and the mechanisms explicitly named in the NVD description.

1. Reconnaissance / target identification. An attacker requires local access to a Linux system as an unprivileged user and the ability to execute a 32-bit (compat) binary on a 64-bit kernel. The target must expose evdev force-feedback functionality; the compat ioctl path must be reachable. The attacker verifies the presence of the affected code path by its behavior rather than by a remote banner.

2. Triggering the flaw. The attacker opens an evdev device that supports force feedback and issues an EVIOCSFF ioctl from a 32-bit compat process. Because input_ff_effect_from_user() only copies the smaller struct ff_effect_compat prefix, the uninitialized tail of the on-stack native struct ff_effect is retained.

3. Persisting and reading back stale memory. input_ff_upload() stores the full native structure into ff->effects[id]. The attacker then uses a uinput-based force-feedback daemon and issues UI_BEGIN_FF_UPLOAD to read the effect back to userspace, obtaining the previously uninitialized kernel stack bytes.

4. Post-exploitation impact. The disclosed stack memory may contain kernel pointers, kernel data structures, or residual secrets that previously occupied that stack region. This is an information-disclosure primitive only; by itself it does not grant code execution or elevation. Its value is as an auxiliary leak that can be combined with other vulnerabilities — for example, to defeat KASLR or to identify kernel addresses for a separate exploitation chain. Each ioctl invocation leaks a fixed-size tail of the current stack frame, so the attacker may repeat the request across different call sites and timing windows to harvest varied stack contents.

No public PoC is available; the chain above is inferred from the vulnerability class and the specific function names present in the NVD description.

Impact Assessment

• Confidentiality: High at the system level — kernel stack memory is disclosed to an unprivileged local user. The leaked region is limited to the tail of the native struct ff_effect as it existed on the stack, so the disclosure is bounded per invocation, but repeated use can accumulate meaningful kernel data.
• Integrity / Availability: No integrity or availability impact is described. The flaw does not corrupt memory or crash the kernel.
• Attack vector: Local (AV:L). A local unprivileged user with access to an evdev device supporting force feedback and the ability to run a 32-bit compat binary is the required precondition.
• Complexity: Low relative to the code path — one ioctl followed by a readback is sufficient, assuming reachability of the compat handler. However, exploit utility depends on what useful data happens to be on the stack, which is probabilistic.
• Business impact: On multi-tenant hosts, container hosts, or shared developer/CI machines, this class of bug weakens the confidentiality boundary between an unprivileged local user and the kernel. The leaked secrets may include cryptographic material, kernel pointers, or residual process data, which is material for environments with strict data-isolation requirements.
• Blast radius: Any compat-capable Linux kernel exposing evdev force-feedback to unprivileged users. Cloud and container platforms that permit 32-bit binaries and expose input devices inherit the exposure. Systems without CONFIG_COMPAT, without force-feedback support, or without unprivileged access to the evdev device are not affected.

CVSS subscores are not published by the vendor or NIST in the provided data; the vector given is inferred from the vulnerability class (local, low complexity, privileged-user not required, confidentiality-only).

Detection Guidance

Sigma Rule

title: Linux Kernel FF Compat Stack Info Leak - EVIOCSFF on 32-bit Process
id: 8b2f0a5c-1d4e-4a6b-9c3e-7f0a1b2c3d4e
status: experimental
description: Detects a 32-bit (compat) process invoking EVIOCSFF on an evdev force-feedback device followed by uinput UI_BEGIN_FF_UPLOAD, consistent with CVE-2026-98201 information disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98201
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_ioctl:
    type: 'SYSCALL'
    syscall|contains: 'ioctl'
    a0|endswith: 'EVIOCSFF'
  selection_uinput:
    type: 'SYSCALL'
    syscall|contains: 'ioctl'
    a0|endswith: 'UI_BEGIN_FF_UPLOAD'
  condition: selection_ioctl or selection_uinput
falsepositives:
  - Legitimate game controllers and haptic applications using force feedback from 32-bit binaries
level: low
tags:
  - attack.t1068
  - attack.t1552

YARA Rule

rule CVE_2026_98201_Linux_FF_Compat_Stack_Leak
{
    meta:
        description = "Detects userland tooling referencing evdev force-feedback compat ioctls associated with CVE-2026-98201"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98201"
        severity = "low"

    strings:
        $s1 = "EVIOCSFF" ascii wide
        $s2 = "UI_BEGIN_FF_UPLOAD" ascii wide
        $s3 = "input_ff_effect_from_user" ascii wide
        $s4 = "ff_effect_compat" ascii wide
        $s5 = "UI_END_FF_UPLOAD" ascii wide

    condition:
        uint32(0) == 0x464c457f and 2 of ($s*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"LOCAL CVE-2026-98201 Linux kernel FF compat ioctl stack info leak - EVIOCSFF observed in payload"; flow:to_server,established; content:"|1b 1c|"; content:"EVIOCSFF"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-recon; sid:9820101; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-98201;)

Note: The underlying vulnerability is a local ioctl; network visibility is only possible where evdev or uinput traffic is proxied or logged in transit (e.g., remote input forwarding). The rule above is a best-effort signature anchored on the ioctl identifier from the description.

Elastic Detection

process where event.type == "start" and process.args != null and
  process.args : ("EVIOCSFF", "UI_BEGIN_FF_UPLOAD") and
  process.thread.capabilities.effective : "CAP_SYS_ADMIN"

/* Local ioctl-based leak: correlate auditd syscall events */
any where event.category == "process" and
  process.name : ("uinput", "evtest", "*ff*") and
  process.args : ("*EVIOCSFF*", "*FF_UPLOAD*")

Splunk SPL Query

index=linux sourcetype=auditd (type=SYSCALL OR syscall=ioctl)
| search (a0="EVIOCSFF" OR a0="UI_BEGIN_FF_UPLOAD" OR a0="UI_END_FF_UPLOAD" OR comm="uinput")
| stats count min(_time) as first_seen max(_time) as last_seen values(a0) as ioctls by host, uid, comm, pid
| where count > 1
| eval risk="low", cve="CVE-2026-98201"
| table first_seen, last_seen, host, uid, comm, pid, ioctls, count, risk, cve
| sort - count

Wazuh OSSEC Rule

<group name="linux,cve_2026_98201,">
  <rule id="982010" level="4">
    <decoded_as>auditd</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">ioctl</field>
    <match>EVIOCSFF|UI_BEGIN_FF_UPLOAD|UI_END_FF_UPLOAD</match>
    <description>CVE-2026-98201: possible Linux kernel FF compat ioctl stack info-leak attempt (EVIOCSFF/UI_BEGIN_FF_UPLOAD)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_98201,audit_ioctl,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict unprivileged access to evdev and uinput device nodes. Ensure device permissions for /dev/input/event* and /dev/uinput are limited to trusted groups; remove world read/write where not required.
• Where force feedback is not needed, disable it (config / module removal) to eliminate the reachable code path.
• Restrict the ability to execute 32-bit compat binaries on 64-bit hosts unless required (e.g., disable CONFIG_IA32_EMULATION or equivalent compat layers where operationally feasible).
• Apply container/runtime sandboxing that denies access to /dev/uinput and input event devices for untrusted workloads.

2) Patch / upgrade steps

• No vendor-published patch reference is available in the provided intelligence. Track the Linux kernel stable and longterm branches for a fix to input_ff_effect_from_user() that zeroes the effect before the compat copy_from_user() (as described in the NVD entry).
• When an upstream commit is published, consume it via your distribution's kernel update channel and rebuild/redeploy. Verify the function now initializes the full native structure prior to the compat copy.
• Because no patch source is tracked, treat detection and access restriction as the primary controls until an official kernel release incorporates the fix.

3) Long-term hardening

• Adopt a kernel update cadence with rapid turnaround for upstream information-disclosure fixes.
• Enforce least privilege on device access via udev rules and systemd/logind ACLs; audit which processes retain /dev/uinput access.
• Enable kernel hardening options and maintain stack-initialization defenses where available, and consider compiler/runtime flags that zero stack allocations for security-sensitive structures.
• Monitor audit logs for repeated EVIOCSFF / UI_BEGIN_FF_UPLOAD activity from non-input applications as a signal of deliberate exploitation attempts.
• Track the CVE in your vulnerability management platform and re-evaluate severity once a CVSS rating and affected version range are published.

References

• NVD — CVE-2026-98201: https://nvd.nist.gov/vuln/detail/CVE-2026-98201
• Linux kernel input subsystem force-feedback and evdev documentation (Documentation/input/)
• MITRE CWE-908 — Use of Uninitialized Resource: https://cwe.mitre.org/data/definitions/908.html
• MITRE CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of reporting; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-98201 in the available data.