CVE-2026-98181
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.
Affected versions
Linux kernel versions
5.13
and later are affected. Fixed in
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-98181?
CVE-2026-98181 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.13 onward and has been patched in 5.15.222, 6.1.189, 6.6.158 and others. CVE-2026-98181 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98181?
Yes. CVE-2026-98181 has been patched. Fixed versions include 5.15.222, 6.1.189, 6.6.158 and others. If you are running Linux kernel 5.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98181 actively exploited?
No. CVE-2026-98181 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.