Out-of-bounds write in Linux kernel - CVE-2026-98181

Vulnerability details

The vulnerability allows an attacker with physical access to write beyond the bounds of an allocated properties array.

The vulnerability exists due to incorrect indexing that causes an out-of-bounds write in the GUD plane property loop when processing properties advertised by a USB device. An attacker with physical access can advertise the maximum number of properties through a USB device to write beyond the bounds of an allocated properties array.

Affected software

How to mitigate CVE-2026-98181

External References

• https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3
• https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9
• https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0
• https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4
• https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d
• https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb
• https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735

Related Security Bulletins

• Out-of-bounds write in Linux kernel drm gud driver
• Debian update for linux