Cloudanix VulnDB

CVE-2026-98181

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel handles certain USB display adapters can let a specially made device corrupt memory inside the system, which could cause crashes or let an attacker gain more control.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in kernel memory caused by incorrect array indexing (req->properties[num_properties + i] while incrementing num_properties) inside the plane property loop in the DRM GUD driver, allowing a USB device advertising maximum properties to write one slot past the end of a 64-slot allocation.

Why it matters to the business

Systems using the Linux kernel DRM GUD driver (common with USB display adapters) face risk of kernel instability, crashes, or local privilege escalation when a malicious or specially crafted USB device is attached; low exploitability reduces immediate ransomware impact but still requires prompt attention on affected distributions.

How an attack unfolds

An attacker supplies a USB device that enumerates as a GUD-compatible display and advertises the maximum number of connector and plane properties; during drm_gud_plane_atomic_check the kernel loop performs the out-of-bounds write while processing the property array, potentially corrupting adjacent kernel memory.

How to fix it

Apply the upstream kernel commit that removes the redundant '+ i' offset so that num_properties is used directly as the running index; rebuild and boot the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the gud_plane_atomic_check function in the kernel source tree for the corrected indexing; alternatively, verify the running kernel version contains the fix and test attachment of a device advertising maximum properties without triggering an OOB condition.

Typical attack path

  1. Attacker prepares USB device or gadget that reports 2 connector and 32 plane properties
  2. Device is physically or virtually connected to the target system
  3. Kernel DRM subsystem calls gud_plane_atomic_check during display configuration
  4. Loop writes beyond allocation boundary, corrupting kernel memory
  5. Resulting crash or controlled memory corruption is leveraged for further exploitation

How to detect it

Review kernel logs (dmesg, journalctl) for oops or BUG reports referencing gud_plane_atomic_check or drm/gud; correlate USB device enumeration events immediately preceding any such crash.

What your security team should do

  • Prioritize kernel updates containing the GUD fix on all systems that may attach arbitrary USB displays
  • Restrict untrusted USB device attachment via policy or hardware controls until patches are deployed
  • Monitor for related kernel oops or panic reports involving drm/gud
  • Reassess after 30 days given stable low EPSS trend

The record

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

Affected packages

Ecosystem Package Introduced Fixed