227 lines
11 KiB
JSON
227 lines
11 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-98181",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2026-09-25T10:25:14.322Z",
|
||
"datePublished": "2026-10-06T08:44:24.284Z",
|
||
"dateUpdated": "2026-10-19T09:15:12.473Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-10-19T09:15:12.473Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: fix out-of-bounds write in gud_plane_atomic_check()\n\nThe plane property loop uses req->properties[num_properties + i] as write\nindex while simultaneously incrementing `num_properties` inside the loop.\nAt iteration i, num_properties has also incremented by i, so the write\nis done at `initial_num_properties + 2*i`, skipping every other index and\nadvancing by 2 per iteration.\n\nWith just 2 connector and 32 plane properties the last write happens at\nindex 64, one slot past the end of the 64-slot (indices 0–63)\nallocation. A USB device can trigger OOB by advertising the maximum\nnumber of properties.\n\nFix by dropping the redundant `+ i`; num_properties is already the correct\nrunning index, as gud_connector_fill_properties() fills the preceding\nslots."
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/gpu/drm/gud/gud_pipe.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "ee04903fe6a098160d20dde4fc5af4cb42846735",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "4153a9e008f2512bd3cf90a319436865847369b9",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "5f5e565410b4987e9663f599f9ab0c350f8338d4",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "7e630edb22088df7aa0d55b02237a71e4c9a523d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "2c92af27ad23e2fbc0367b11a9027d36d94ef4b3",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "ea57100955c1c2a525ba1a98c18d9a05b25aeedb",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
|
||
"lessThan": "59ced288fcba9e91bd38e61a972ad782c4edb7d0",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/gpu/drm/gud/gud_pipe.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.13",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.13",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.222",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.189",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.158",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.12.112",
|
||
"lessThanOrEqual": "6.12.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.18.54",
|
||
"lessThanOrEqual": "6.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "7.2.8",
|
||
"lessThanOrEqual": "7.2.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "7.3",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "5.15.222"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "6.1.189"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "6.6.158"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "6.12.112"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "6.18.54"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "7.2.8"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.13",
|
||
"versionEndExcluding": "7.3"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0"
|
||
}
|
||
],
|
||
"title": "drm/gud: fix out-of-bounds write in gud_plane_atomic_check()",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
}
|
||
}
|
||
} |