Cloudanix VulnDB

CVE-2026-98148

None

CVSS

—

EPSS

0.2%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A graphics driver bug can cause warnings or instability when certain display devices are connected, which is fixed by updating the operating system kernel.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing validation that GUD_ROTATION_0 is included in the device-reported supported rotations bitmask before passing it to drm_plane_create_rotation_property causes the internal WARN_ON(rotation & ~supported_rotations) assertion to fire in the DRM core.

Why it matters to the business

Systems using the GUD display driver with certain USB display devices may experience kernel warnings or instability during graphics initialization, potentially affecting display functionality and requiring reboots or driver workarounds.

How an attack unfolds

An attacker with the ability to present a malicious or misbehaving GUD-compatible display device to the system can supply a rotation bitmask that omits the required GUD_ROTATION_0 bit, triggering the unvalidated path in the kernel driver and producing a warning condition.

How to fix it

Update to a Linux kernel version containing the fix that skips rotation property creation when GUD_ROTATION_0 is absent; rebuild and reboot after applying the patch.

How to confirm the fix worked

Confirm the presence of the validation check for GUD_ROTATION_0 before drm_plane_create_rotation_property in the gud driver source; test with a device reporting incomplete rotation bits and verify no WARN_ON occurs.

Typical attack path

  1. Connect a GUD device that omits GUD_ROTATION_0 from its reported rotation property
  2. Kernel loads drm/gud and calls drm_plane_create_rotation_property with the incomplete bitmask
  3. WARN_ON triggers in the DRM core due to rotation argument not being subset of supported_rotations

How to detect it

Search kernel logs for drm_plane_create_rotation_property WARN_ON messages triggered during GUD device probe; review dmesg or journalctl output around USB display device attachment events.

What your security team should do

  • Apply the upstream kernel fix for the GUD rotation validation as soon as a patched release is available
  • Monitor graphics driver initialization logs for the specific WARN_ON pattern during device enumeration
  • Limit use of untrusted or non-standard USB display devices until patched kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUD_ROTATION_0 is present in supported rotations The rotation argument to drm_plane_create_rotation_property() is set to DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as the supported_rotations argument. The driver never validates that GUD_ROTATION_0 is present, so a device that omits it from its GUD_PROPERTY_ROTATION triggers the WARN_ON(rotation & ~supported_rotations) in drm_plane_create_rotation_property() Fix this by skipping the creation of rotation property if the device doesn't have the GUD_ROTATION_0 bit

Affected packages

Ecosystem Package Introduced Fixed