CVE-2026-98181: Linux kernel · drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ee04903fe6a098160d20dde4fc5af4cb42846735 : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in ee04903fe6a098160d20dde4fc5af4cb42846735, ea57100955c1c2a525ba1a98c18d9a05b25aeedb, 4153a9e008f2512bd3cf90a319436865847369b9 +4
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in specific commits to the Linux kernel. Users and administrators should update affected Linux kernel versions, specifically version 5.13, to the fixed versions referenced by the commit hashes. No additional mitigation actions are indicated by the vendor advisory.
Description
CVE-2026-98181 is an out-of-bounds write vulnerability in the Linux kernel's drm/gud component, specifically in the gud_plane_atomic_check() function. The flaw arises from incorrect indexing during a loop that writes plane properties, causing writes beyond allocated memory bounds. This can be triggered by a USB device advertising the maximum number of properties. The issue has been fixed by correcting the indexing logic.
References
- git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735 (opens in a new tab)
- git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9 (opens in a new tab)
- git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4 (opens in a new tab)
- git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d (opens in a new tab)
- git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3 (opens in a new tab)
- git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb (opens in a new tab)
- git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0 (opens in a new tab)