CVE-2026-89817: drm/gud: NUL-terminate TV mode names read from the device
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: NUL-terminate TV mode names read from the device
gudconnectoraddtvmode() reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy(), which calls strlen() on each one. Nothing guarantees the device NUL-terminates a name, so strlen() can run past the end of a slot and, for the last mode, past the end of the allocation.
Terminate each name at the end of its slot before use.
Affected Software
Event History
Frequently Asked Questions
What would an attacker need to exploit this issue?
An attacker would need to control or emulate a USB GUD display device that supplies TV mode names without NUL terminators. The vulnerable path is reached when the kernel reads those mode names and creates legacy TV mode properties.
What is the impact of malformed mode names?
The kernel can read beyond the fixed-size mode-name slot when strlen() processes an unterminated name. For the final mode entry, the read can extend beyond the allocated buffer.
How can I determine whether a system may be exposed?
Systems using the Linux kernel DRM GUD driver with USB GUD display devices are relevant. Inspect the kernel version or source for the cited stable fixes, which add termination of every mode name at the end of its fixed-size slot before it is used.