CVE-2026-93234

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: validate TV mode names before creating enum property

The GUD protocol returns TV mode names as fixed-size

GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be

NUL-terminated.

gud_connector_add_tv_mode() currently passes each fixed-size entry

directly to drm_mode_create_tv_properties_legacy(), which eventually

reaches drm_property_add_enum() and strlen(). If a device returns an

entry without a terminating NUL byte, strlen() reads past the end of

the slot and can run beyond the allocated buffer, triggering an

out-of-bounds read.

Validate that each returned TV mode name contains a NUL terminator

within its fixed-size slot before passing it to the DRM property code.

If a malformed entry is found, reject the device response with -EIO.

This fixes the out-of-bounds read without changing the handling of

valid devices, and avoids silently truncating malformed protocol data.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References