drm/gud: validate TV mode names before creating enum property (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.21 % · centile 11 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.
Références
- https://git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd
- https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f
- https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc
- https://git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e
- https://git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad
- https://git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f
- https://git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437
Références européennes
- ENISA EUVD · EUVD-2026-86239
- GCVE · GCVE-0-2026-93234
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 676f1fb3632bbc9ce83be7938e93fe6bfc9510fd ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 06fcaf21c18ac88f57fee3803554f48c6026b95f ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 082e378886547b5b1c4075ed307f7c68547868dc ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 70cffc31a380b3eae45027101647aa94c242aa0e ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 72a95df6bbc7d20c7af1e39d86b3e910cccd01ad ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < eab46d9629807db1b5647d17227e16110a18227f |
| Linux · Linux | affected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* ; unaffected 6.12.110 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |