FlawAtlas
Search the atlas
CVE-2025-40035 Not scored

Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields.

Exploit probability 0.2%
Published October 28, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:15702-1
related OPENSUSE-SU-2025:20091-1
related OPENSUSE-SU-2026:10301-1
related SUSE-SU-2025:21040-1
related SUSE-SU-2025:21052-1
related SUSE-SU-2025:21056-1
related SUSE-SU-2025:21064-1
related SUSE-SU-2025:21080-1
related SUSE-SU-2025:21147-1
related SUSE-SU-2025:21180-1
related SUSE-SU-2025:4057-1
related SUSE-SU-2025:4128-1
related SUSE-SU-2025:4132-1
related SUSE-SU-2025:4140-1
related SUSE-SU-2025:4141-1
related SUSE-SU-2025:4301-1
related SUSE-SU-2026:0316-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-40035

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields.

View original source

05 / REFERENCES

Further evidence