Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93234

drm/gud: validate TV mode names before creating enum property

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in 676f1fb3632bbc9ce83be7938e93fe6bfc9510fd; From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in 06fcaf21c18ac88f57fee3803554f48c6026b95f; From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in 082e378886547b5b1c4075ed307f7c68547868dc; From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in 70cffc31a380b3eae45027101647aa94c242aa0e; From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in 72a95df6bbc7d20c7af1e39d86b3e910cccd01ad; From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in eab46d9629807db1b5647d17227e16110a18227f; From 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 · fixed in da1ea35fea67ad841f4ada28dd61b41be65e5437

  • Linux Linux

    5.13

  • KernelLinux

    From 5.13.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5

References 7

git.kernel.org