Executive brief
The GUD USB display driver in the Linux kernel improperly processes TV mode names received from a USB device without verifying they are properly null-terminated. A malicious or malfunctioning USB device could send unterminated strings, causing the kernel to read past allocated memory boundaries. This can lead to information disclosure or kernel crashes, affecting system availability and potentially exposing sensitive kernel memory.
Technical details
The vulnerability exists in gud_connector_add_tv_mode() in the drm/gud driver, which reads fixed-size mode name buffers from an untrusted USB device and passes pointers to drm_mode_create_tv_properties_legacy(). The function calls strlen() on each mode name without ensuring NUL-termination, allowing string functions to over-read past the slot boundary and, for the last mode, past the allocation itself. This is a buffer over-read (CWE-125) in kernel space triggered by a USB device (network/adjacent attack vector). The fix adds explicit NUL-termination at the end of each fixed-size slot before processing. Patch is available in mainline and stable kernels.
Affected products
- Linux Linux kernel All versions with drm/gud driver (introduced in commit 40e1a70b4aed)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-16: patched: Fix committed upstream (500cb24cd61bad8a2747ddfc49b7034899c82d94)