drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.
CVE-2026-98181
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98181
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "ee04903fe6a098160d20dde4fc5af4cb42846735",
"versionType": "git"
},
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "4153a9e008f2512bd3cf90a319436865847369b9",
"versionType": "git"
},
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "5f5e565410b4987e9663f599f9ab0c350f8338d4",
"versionType": "git"
},
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "7e630edb22088df7aa0d55b02237a71e4c9a523d",
"versionType": "git"
},
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "2c92af27ad23e2fbc0367b11a9027d36d94ef4b3",
"versionType": "git"
},
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "ea57100955c1c2a525ba1a98c18d9a05b25aeedb",
"versionType": "git"
},
{
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"lessThan": "59ced288fcba9e91bd38e61a972ad782c4edb7d0",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/gud/gud_pipe.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/gud/gud_pipe.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98181
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38264 · Revision 1
- Added to Heist Feed
- Publisher date