# CVE-2026-93234: Linux kernel DRM GUD driver out-of-bounds read in TV mode names

Source: https://junglewise.ai/threats/cve-2026-93234-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93234 · Severity: info · Published 2026-09-24

The Linux kernel's GUD (Generic USB Display) driver, which supports USB-connected display devices, fails to properly validate TV mode name data from the device. A malicious or malfunctioning USB display device that sends improperly formatted mode names can trigger an out-of-bounds memory read in the kernel, potentially causing a denial of service or information disclosure.

Technologies: [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel). Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-93234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93234 being exploited in the wild.

**How severe is CVE-2026-93234?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** Unknown Linux kernel from approximately 5.9 (when GUD driver was added) through 6.12+.

**Is there a fix for CVE-2026-93234?** A patch was published on 2026-09-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93234 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-93234?** Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The gud_connector_add_tv_mode() function in the DRM GUD driver processes TV mode names from device responses without verifying they are NUL-terminated within their fixed-size buffer slots. When strlen() is called on an unterminated buffer, it reads past the allocated boundary. The fix validates that each mode name contains a NUL terminator before passing it to drm_property_add_enum(), rejecting malformed responses with -EIO.

## Affected products

- <UNKNOWN> Linux kernel from approximately 5.9 (when GUD driver was added) through 6.12+

## Timeline

- 2026-09-24: disclosed
- 2026-09-14: patched

## References

- [https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f](https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f)
- [https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc](https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc)

## Related threats

- [Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel NTFS race condition in page fault handler](https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel i915 DMC firmware load address validation bypass](https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)