CVE-2026-89817 drm/gud: NUL-terminate TV mode names read from the device
A missing null termination in the Linux kernel DRM gud driver allows reading out-of-bounds memory or causing a crash when processing TV mode names from a USB device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89817?
CVE-2026-89817 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: NUL-terminate TV mode names read from the device
gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drm_mode_create_tv_properties_legacy(), which calls strlen() on each one. Nothing guarantees the device NUL-terminates a name, so strlen() can run past the end of a slot and, for the last mode, past the end of the allocation.
Terminate each name at the end of its slot before use.
Which versions are affected by CVE-2026-89817?
How do I fix CVE-2026-89817?
Apply the vendor's patch.
Is CVE-2026-89817 being exploited?
There is no known exploitation of CVE-2026-89817 in the wild and no public exploit code.
Sources
Also known as AZL-101306, BELL-CVE-2026-89817, DEBIAN-CVE-2026-89817, GHSA-g57w-mh9m-gp2m, UBUNTU-CVE-2026-89817.