drm/gud: validate TV mode names before creating enum property (Linux Linux)

CVE-2026-93234
Non disponible

En bref

Source
NVD
EPSS
EPSS 0.21 % · centile 11 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Received

Description

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.

Références

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 676f1fb3632bbc9ce83be7938e93fe6bfc9510fd ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 06fcaf21c18ac88f57fee3803554f48c6026b95f ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 082e378886547b5b1c4075ed307f7c68547868dc ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 70cffc31a380b3eae45027101647aa94c242aa0e ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < 72a95df6bbc7d20c7af1e39d86b3e910cccd01ad ; affected 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 < eab46d9629807db1b5647d17227e16110a18227f
Linux · Linuxaffected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* ; unaffected 6.12.110 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD