CVE-2026-98181

Summary

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing num_properties inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at initial_num_properties + 2*i, skipping every other index and advancing by 2 per iteration.

With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties.

Fix by dropping the redundant + i; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < ee04903fe6a098160d20dde4fc5af4cb42846735affected
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 4153a9e008f2512bd3cf90a319436865847369b9affected
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 5f5e565410b4987e9663f599f9ab0c350f8338d4affected
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 7e630edb22088df7aa0d55b02237a71e4c9a523daffected
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 2c92af27ad23e2fbc0367b11a9027d36d94ef4b3affected
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < ea57100955c1c2a525ba1a98c18d9a05b25aeedbaffected
LinuxLinux40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 59ced288fcba9e91bd38e61a972ad782c4edb7d0affected
LinuxLinux5.13affected
LinuxLinux0 < 5.13unaffected
LinuxLinux5.15.222 <= 5.15.*unaffected
LinuxLinux6.1.189 <= 6.1.*unaffected
LinuxLinux6.6.158 <= 6.6.*unaffected
LinuxLinux6.12.112 <= 6.12.*unaffected
LinuxLinux6.18.54 <= 6.18.*unaffected
LinuxLinux7.2.8 <= 7.2.*unaffected
LinuxLinux7.3-rc4 <= *unaffected

Weaknesses

References