CVE-2026-93234

drm/gud: validate TV mode names before creating enum property

Published Sep 24, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: validate TV mode names before creating enum property

The GUD protocol returns TV mode names as fixed-size
GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be
NUL-terminated.

gud_connector_add_tv_mode() currently passes each fixed-size entry
directly to drm_mode_create_tv_properties_legacy(), which eventually
reaches drm_property_add_enum() and strlen(). If a device returns an
entry without a terminating NUL byte, strlen() reads past the end of
the slot and can run beyond the allocated buffer, triggering an
out-of-bounds read.

Validate that each returned TV mode name contains a NUL terminator
within its fixed-size slot before passing it to the DRM property code.
If a malformed entry is found, reject the device response with -EIO.

This fixes the out-of-bounds read without changing the handling of
valid devices, and avoids silently truncating malformed protocol data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< 676f1fb3632bbc9ce83be7938e93fe6bfc9510fd
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< 06fcaf21c18ac88f57fee3803554f48c6026b95f
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< 082e378886547b5b1c4075ed307f7c68547868dc
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< 70cffc31a380b3eae45027101647aa94c242aa0e
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< 72a95df6bbc7d20c7af1e39d86b3e910cccd01ad
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< eab46d9629807db1b5647d17227e16110a18227f
`40e1a70b4aedf2859a1829991b48ef0ebe650bf2`	affected	< da1ea35fea67ad841f4ada28dd61b41be65e5437

Linux

affected

Version	Status	Constraints
`5.13`	affected	—
`0`	unaffected	< 5.13
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,676f1fb3632bbc9ce83be7938e93fe6bfc9510fd)`	affected	code_commit	—
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,06fcaf21c18ac88f57fee3803554f48c6026b95f)`	affected	code_commit	—
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,082e378886547b5b1c4075ed307f7c68547868dc)`	affected	code_commit	—
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,70cffc31a380b3eae45027101647aa94c242aa0e)`	affected	code_commit	—
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,72a95df6bbc7d20c7af1e39d86b3e910cccd01ad)`	affected	code_commit	—
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,da1ea35fea67ad841f4ada28dd61b41be65e5437)`	affected	code_commit	—
`[40e1a70b4aedf2859a1829991b48ef0ebe650bf2,eab46d9629807db1b5647d17227e16110a18227f)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.13`	affected	semver	—
`[0,5.13)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.211% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f
https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc
https://git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd
https://git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e
https://git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad
https://git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437
https://git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f

History

Sep 25, 2026 11:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-126

Sep 24, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.
Title		drm/gud: validate TV mode names before creating enum property
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc https://git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd https://git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e https://git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad https://git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437 https://git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f