CVE-2026-98181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

The plane property loop uses req->properties[num_properties + i] as write

index while simultaneously incrementing `num_properties` inside the loop.

At iteration i, num_properties has also incremented by i, so the write

is done at `initial_num_properties + 2*i`, skipping every other index and

advancing by 2 per iteration.

With just 2 connector and 32 plane properties the last write happens at

index 64, one slot past the end of the 64-slot (indices 0–63)

allocation. A USB device can trigger OOB by advertising the maximum

number of properties.

Fix by dropping the redundant `+ i`; num_properties is already the correct

running index, as gud_connector_fill_properties() fills the preceding

slots.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References