CVE-2026-98181 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
The plane property loop uses req->properties[num_properties + i] as write
index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration.
With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties.
Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Linux kernel's Display Resource Manager (DRM) subsystem specifically affects the Generic USB Display driver module known as gud. This flaw manifests as an out-of-bounds write within the function gud_plane_atomic_check, which is responsible for validating plane properties during atomic display updates. The root cause lies in a logic error involving array indexing and loop iteration management. Specifically, the code utilizes req->properties[num_properties + i] to determine the memory location for writing property data. However, inside this same loop, the variable num_properties is incremented with each iteration. This creates a compounding index calculation where the write position advances by two slots per iteration rather than one. At any given iteration i, the effective index becomes initial_num_properties plus twice the current iteration count, causing the pointer to skip over valid memory locations and rapidly approach or exceed allocated boundaries.
The operational impact of this vulnerability is significant when interacting with maliciously crafted USB devices. An attacker controlling a USB display device can exploit this flaw by advertising the maximum number of supported properties. In scenarios involving two connectors and thirty-two plane properties, the cumulative effect of the double-indexing error results in a write operation at index sixty-four. Since the allocated array for these properties contains only sixty-four slots with indices ranging from zero to sixty-three, this access occurs one slot past the end of the buffer. This constitutes an out-of-bounds write that can corrupt adjacent memory structures within the kernel space. Such corruption may lead to system instability, crashes, or potentially allow a local attacker to execute arbitrary code by overwriting critical function pointers or control data in nearby memory regions.
From a classification perspective, this vulnerability aligns with CWE-787, which denotes an out-of-bounds write error resulting from improper validation of array indices. The exploitation vector falls under ATT&CK technique T1059, specifically command and script interpretation via local execution if the attacker has initial access to trigger the USB device interaction. While typically requiring physical proximity or a compromised peripheral, this flaw highlights the risks associated with trusting input data structures from external hardware interfaces without rigorous bounds checking. The vulnerability underscores the importance of careful index management in kernel drivers that handle dynamic property lists from user-space or hardware sources.
The resolution involves correcting the indexing logic within gud_plane_atomic_check by removing the redundant addition of i to the num_properties variable. Since num_properties is already maintained as a running counter that correctly tracks the current position, and because gud_connector_fill_properties ensures preceding slots are properly filled, adding i causes the aforementioned double advancement. By relying solely on num_properties as the index, the driver writes data sequentially into consecutive memory locations without exceeding the allocated buffer size. This fix restores proper bounds adherence and prevents the out-of-bounds write condition. System administrators should ensure that kernel updates incorporating this patch are applied promptly to mitigate risks associated with untrusted USB display devices connected to affected systems.