CVE-2026-98181
Received Received - Intake

Out-of-Bounds Write in Linux Kernel DRM GUD Driver

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98181
EUVD
EUVD-2026-93109

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 40e1a70b4aedf2859a1829991b48ef0ebe650bf2
Linux Linux 5.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's drm/gud driver. It occurs when handling plane properties during atomic checks. The loop incorrectly calculates the write index by adding both the loop counter and an incrementing num_properties variable, causing writes to skip indices and eventually exceed the allocated buffer size. This leads to out-of-bounds memory access.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/gud driver and requires kernel-level access to detect. No direct network detection commands are available. Check kernel logs for OOB write errors or crashes related to drm/gud. Use commands like dmesg | grep -i gud or journalctl -k | grep -i gud to inspect kernel logs.

Impact Analysis

An attacker with physical or remote access to a vulnerable system could exploit this flaw to execute arbitrary code, escalate privileges, or cause a denial-of-service condition. The vulnerability can be triggered by a USB device advertising excessive properties, potentially compromising system integrity.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for CVE-2026-98181. If immediate patching is not possible, disable the drm/gud driver module via rmmod gud or blacklist it in /etc/modprobe.d/. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart