Not yet scoredPublished Sep 25, 2026

CVE-2026-98148drm/gud: validate GUD_ROTATION_0 is present in supported rotations

Updated under an hour ago (2026-10-19 11:20 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations The rotation argument to drm_plane_create_rotation_property() is set to DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as the supported_rotations argument. The driver never validates that GUD_ROTATION_0 is present, so a device that omits it from its GUD_PROPERTY_ROTATION triggers the WARN_ON(rotation & ~supported_rotations) in drm_plane_create_rotation_property() Fix this by skipping the creation of rotation property if the device doesn't have the GUD_ROTATION_0 bit

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before b2cd682324b889011874cf844b7c7efa97c97296; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 876b33d8a9a00e9d4bbcbb7f55ad2c05974850de; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before cb732d027aa18e1fcf9d2797f47d20b179ebc59c	CNA record

References

https://git.kernel.org/stable/c/b2cd682324b889011874cf844b7c7efa97c97296
https://git.kernel.org/stable/c/876b33d8a9a00e9d4bbcbb7f55ad2c05974850de
https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.