CVE-2026-98181drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 13 days later
· 13 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < ee04903fe6a098160d20dde4fc5af4cb42846735
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < 4153a9e008f2512bd3cf90a319436865847369b9
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < 5f5e565410b4987e9663f599f9ab0c350f8338d4
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < 7e630edb22088df7aa0d55b02237a71e4c9a523d
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < 2c92af27ad23e2fbc0367b11a9027d36d94ef4b3
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < ea57100955c1c2a525ba1a98c18d9a05b25aeedb
- affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 – < 59ced288fcba9e91bd38e61a972ad782c4edb7d0
- affected 5.13
- unaffected < 5.13
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References7
- https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735 (opens in a new tab)
- https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9 (opens in a new tab)
- https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4 (opens in a new tab)
- https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d (opens in a new tab)
- https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3 (opens in a new tab)
- https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb (opens in a new tab)
- https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93109 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98181)Record last updated .