CVE-2026-98148

Awaiting Analysis Awaiting Analysis - Queue

Rotation Property Validation Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations The rotation argument to drm_plane_create_rotation_property() is set to DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as the supported_rotations argument. The driver never validates that GUD_ROTATION_0 is present, so a device that omits it from its GUD_PROPERTY_ROTATION triggers the WARN_ON(rotation & ~supported_rotations) in drm_plane_create_rotation_property() Fix this by skipping the creation of rotation property if the device doesn't have the GUD_ROTATION_0 bit

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98148

EUVD

EUVD-2026-86979

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the GUD (Generic USB Display) driver. It occurs when the rotation property for a display plane is created without validating that the device supports the default rotation mode (GUD_ROTATION_0). This can lead to a warning or potential instability if the device's supported rotation modes do not include the default.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM subsystem and relates to rotation property handling in GPU drivers. Detection requires checking kernel logs for warnings related to rotation properties or examining the kernel version for the affected code paths. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could cause system instability or crashes when certain display operations are performed, particularly when rotation properties are involved. Users might experience graphical glitches, application failures, or system freezes if the affected driver is used with unsupported hardware.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue related to rotation property validation in display hardware, which does not involve data processing, storage, or privacy concerns typically addressed by these regulations.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. Monitor kernel logs for rotation-related warnings after updating. If you cannot update immediately, consider disabling affected GPU drivers or rotation features as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-98148. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70