All vulnerabilities
CVE-2026-93234

Linux: drm/gud: validate TV mode names before creating enum property

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in676f1fb3632bbc9ce83be7938e93fe6bfc9510fdAlso 06fcaf21c18ac88f57fee3803554f48c6026b95f, 082e378886547b5b1c4075ed307f7c68547868dc and 2 moreCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 676f1fb3632bbc9ce83be7938e93fe6bfc9510fdLinuxCVE List
  • 06fcaf21c18ac88f57fee3803554f48c6026b95fLinuxCVE List
  • 082e378886547b5b1c4075ed307f7c68547868dcLinuxCVE List
  • 70cffc31a380b3eae45027101647aa94c242aa0eLinuxCVE List
  • 72a95df6bbc7d20c7af1e39d86b3e910cccd01adLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: validate TV mode names before creating enum property

The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated.

gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read.

Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO.

This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.

Text from CVE List

Affected versions 16

  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 676f1fb3632bbc9ce83be7938e93fe6bfc9510fdCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 06fcaf21c18ac88f57fee3803554f48c6026b95fCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 082e378886547b5b1c4075ed307f7c68547868dcCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 70cffc31a380b3eae45027101647aa94c242aa0eCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 72a95df6bbc7d20c7af1e39d86b3e910cccd01adCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before eab46d9629807db1b5647d17227e16110a18227fCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before da1ea35fea67ad841f4ada28dd61b41be65e5437CVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 5.15.221 through 5.15.*CVE List
  • Linuxunaffected: 6.1.188 through 6.1.*CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.51 through 6.18.*CVE List
  • Linuxunaffected: 7.2.5 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7