CVE-2026-98181drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before ee04903fe6a098160d20dde4fc5af4cb42846735; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 4153a9e008f2512bd3cf90a319436865847369b9; 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 builds before 5f5e565410b4987e9663f599f9ab0c350f8338d4; 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 builds before 7e630edb22088df7aa0d55b02237a71e4c9a523d; 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 builds before 2c92af27ad23e2fbc0367b11a9027d36d94ef4b3; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before ea57100955c1c2a525ba1a98c18d9a05b25aeedb; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 before 59ced288fcba9e91bd38e61a972ad782c4edb7d0 | CNA record |
References
- https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735
- https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9
- https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4
- https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d
- https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3
- https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb
- https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.