CVE-2026-89817 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: NUL-terminate TV mode names read from the device
gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drm_mode_create_tv_properties_legacy(), which calls strlen() on each one. Nothing guarantees the device NUL-terminates a name, so strlen() can run past the end of a slot and, for the last mode, past the end of the allocation.
Terminate each name at the end of its slot before use.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's Display Resource Manager (DRM) subsystem specifically affects the Gud driver, which handles USB-based display adapters. This issue arises from a lack of proper input validation and boundary checking when processing TV mode names retrieved from external hardware devices. The function gud_connector_add_tv_mode is responsible for reading fixed-size buffers containing mode name strings directly from the connected USB device. These pointers are subsequently passed to drm_mode_create_tv_properties_legacy, which internally invokes strlen() to determine the length of each string before further processing or storage within kernel memory structures.
The core technical flaw lies in the assumption that data received from external peripherals is well-formed and strictly adheres to expected formatting conventions. Specifically, there is no guarantee that the USB device will NUL-terminate the mode name strings it transmits. When strlen() executes on a string lacking this termination character, it continues reading memory sequentially until it encounters a zero byte by chance. In many cases, particularly when processing the last mode in a sequence, this results in an out-of-bounds read that extends beyond the allocated buffer boundary. This constitutes a classic case of improper input validation leading to potential information disclosure or kernel instability depending on what data resides immediately after the buffer allocation.
From a security classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. It also relates to CWE-20, Improper Input Validation, as the system fails to verify that incoming data meets expected structural requirements such as proper string termination. In terms of attack vectors and tactical behavior within the MITRE ATT&CK framework, this flaw could potentially be leveraged for information leakage if an attacker can control or manipulate the USB device's response content. By carefully crafting a malicious device firmware that omits NUL terminators in specific positions, an adversary might force the kernel to read sensitive memory contents adjacent to the buffer, thereby gaining insights into other kernel data structures or user-space memory layouts through side-channel effects or subsequent crashes that reveal stack traces.
The operational impact of this vulnerability ranges from minor display configuration errors to severe system instability. If strlen() reads into unmapped memory pages, it will trigger a page fault leading to an immediate kernel panic and system crash, resulting in a denial-of-service condition for the host machine. Even if the read occurs within mapped but unintended memory regions, it may lead to corrupted data being processed by downstream DRM functions, potentially causing graphical artifacts or driver failures. While exploitation typically requires physical access to plug in a malicious USB device, this represents a significant risk in environments where untrusted peripherals are connected, such as public kiosks or shared workstations.
To mitigate this vulnerability, the primary remediation involves ensuring that all strings read from external devices are explicitly NUL-terminated before being passed to functions expecting standard C-style strings. The fix implemented by terminating each name at the end of its allocated slot ensures that strlen() and subsequent string operations remain within safe bounds regardless of how the device transmits data. System administrators should apply kernel updates provided by their distribution vendors as soon as they become available, ensuring that the patched version of the gud driver is active. Additionally, organizations relying on USB display adapters should implement strict peripheral management policies to prevent unauthorized devices from connecting to critical infrastructure systems, thereby reducing the attack surface for such hardware-based injection vulnerabilities.