In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - sanitize event type index when fetching event masks

The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
ioctls is used to index the static counts array in evdev_get_mask_cnt()
and client evmasks array in evdev_get_mask().

While the event type is architecturally bounded by EV_CNT, speculative
execution may mispredict bounds checks and perform out-of-bounds loads.

Sanitize the event type index in evdev_get_mask_cnt() branchlessly using
array_index_mask_nospec(). This clamps the index to 0 for safe array
access and forces the returned count to 0 speculatively when the index
is out of bounds.

We do not need additional array_index_nospec() calls in evdev_get_mask()
because evdev_get_mask_cnt() speculatively forces the count (and
resulting xfer_size) to 0 for out-of-bounds types, preventing any
speculative memory access to client evmasks array.

https://git.kernel.org/stable/c/3abd29c61d2ef37c4102cf755b18be53bb9dbea6

https://git.kernel.org/stable/c/4034ef247a9dde3f56660b01f0c3280dac6b1274

https://git.kernel.org/stable/c/433913b4a92214d76e9f0c03ad9128fec943d5f8

https://git.kernel.org/stable/c/5db341189bb7ff041d570dbe36ecca7e32913927

https://git.kernel.org/stable/c/810e1883d4815f29c30d900ad7333d03cc2515d1

https://git.kernel.org/stable/c/c79b08d8fa230871a3634e34a66e591ac2d084ef

https://git.kernel.org/stable/c/f27fa9b39f925d26e034a1f382cb45523138f4ae

https://git.kernel.org/stable/c/f3fc329acad9a71b3c077237cbac20670d2358c8

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/evdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c79b08d8fa230871a3634e34a66e591ac2d084ef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f27fa9b39f925d26e034a1f382cb45523138f4ae","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f3fc329acad9a71b3c077237cbac20670d2358c8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5db341189bb7ff041d570dbe36ecca7e32913927","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"433913b4a92214d76e9f0c03ad9128fec943d5f8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4034ef247a9dde3f56660b01f0c3280dac6b1274","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"810e1883d4815f29c30d900ad7333d03cc2515d1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3abd29c61d2ef37c4102cf755b18be53bb9dbea6","versionType":"git","status":"affected"},{"version":"0","lessThan":"5.10.265","versionType":"semver","status":"affected"},{"version":"0","lessThan":"5.15.216","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.1.183","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.6.152","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.12.104","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.45","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.1.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/evdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]