All vulnerabilities
CVE-2026-98181

Linux: drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4153a9e008f2512bd3cf90a319436865847369b9Also 5f5e565410b4987e9663f599f9ab0c350f8338d4, 7e630edb22088df7aa0d55b02237a71e4c9a523d and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4153a9e008f2512bd3cf90a319436865847369b9LinuxCVE List
  • 5f5e565410b4987e9663f599f9ab0c350f8338d4LinuxCVE List
  • 7e630edb22088df7aa0d55b02237a71e4c9a523dLinuxCVE List
  • 2c92af27ad23e2fbc0367b11a9027d36d94ef4b3LinuxCVE List
  • 59ced288fcba9e91bd38e61a972ad782c4edb7d0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing num_properties inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at initial_num_properties + 2*i, skipping every other index and advancing by 2 per iteration.

With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties.

Fix by dropping the redundant + i; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

Text from CVE List

Affected versions 16

  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before ee04903fe6a098160d20dde4fc5af4cb42846735CVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 4153a9e008f2512bd3cf90a319436865847369b9CVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 5f5e565410b4987e9663f599f9ab0c350f8338d4CVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 7e630edb22088df7aa0d55b02237a71e4c9a523dCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 2c92af27ad23e2fbc0367b11a9027d36d94ef4b3CVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before ea57100955c1c2a525ba1a98c18d9a05b25aeedbCVE List
  • Linuxaffected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 59ced288fcba9e91bd38e61a972ad782c4edb7d0CVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7