CVE-2026-98181
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
No known exploitation. EPSS puts it in the 6th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, < ee04903fe6a098160d20dde4fc5af4cb42846735Upgrade to: ee04903fe6a098160d20dde4fc5af4cb42846735Affected: ≥ 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, < 4153a9e008f2512bd3cf90a319436865847369b9Upgrade to: 4153a9e008f2512bd3cf90a319436865847369b9Affected: ≥ 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, < 5f5e565410b4987e9663f599f9ab0c350f8338d4Upgrade to: 5f5e565410b4987e9663f599f9ab0c350f8338d4Affected: ≥ 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, < 7e630edb22088df7aa0d55b02237a71e4c9a523dUpgrade to: 7e630edb22088df7aa0d55b02237a71e4c9a523d + 3 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 6th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735
- git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9
- git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4
And 4 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI