drm/gud: validate TV mode names before creating enum property

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-93234
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-24 16:17:19 UTC
Updated2026-09-24 16:17:19 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 676f1fb3632bbc9ce83be7938e93fe6bfc9510fd git Not specified
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 06fcaf21c18ac88f57fee3803554f48c6026b95f git Not specified
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 082e378886547b5b1c4075ed307f7c68547868dc git Not specified
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 70cffc31a380b3eae45027101647aa94c242aa0e git Not specified
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 72a95df6bbc7d20c7af1e39d86b3e910cccd01ad git Not specified
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 eab46d9629807db1b5647d17227e16110a18227f git Not specified
CNA Linux Linux affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 da1ea35fea67ad841f4ada28dd61b41be65e5437 git Not specified
CNA Linux Linux affected 5.13 Not specified
CNA Linux Linux unaffected 5.13 semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.51 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.5 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report