CVE-2026-74683

This moderate-impact flaw affects the Linux kernel in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. A local user with access to an evdev device could pass a specially crafted event type index to the EVIOCGMASK or EVIOCSMASK ioctls. Although the event type is architecturally bounded by EV_CNT, speculative execution may mispredict the bounds checks and perform out-of-bounds loads when the index is used to access the kernel's internal event mask arrays, potentially resulting in the disclosure of kernel memory contents. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) streams and Red Hat In-Vehicle OS 2 are affected, with the fix deferred to a future update; the deferral reflects the limited practical exploitability of this speculative side channel, and the residual risk is that a local attacker could potentially disclose small amounts of kernel memory. Red Hat Enterprise Linux 6 is out of support scope, so no fix is planned for that stream. Red Hat's moderate rating is lower than the initially suggested high severity because exploitation requires local access with high attack complexity and yields only a limited, side-channel-based disclosure; the Red Hat CVSS:3.1 score (5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) additionally weights potential availability impact.