CVE-2026-98181

Description

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

Is your site exposed to CVE-2026-98181?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0022

Probability of exploitation

0.11%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3 https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9 https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0 https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4 https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735

Frequently Asked Questions

What is CVE-2026-98181? +

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

How do I check if I'm vulnerable to CVE-2026-98181? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.