CVE-2026-93234 drm/gud: validate TV mode names before creating enum property

Not scored Published 24 Sep 2026 Updated 19 Oct 2026

A malicious USB display device can trigger an out-of-bounds read in the Linux kernel DRM driver, potentially causing a crash or leaking memory.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-93234?

CVE-2026-93234 is a memory corruption vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: validate TV mode names before creating enum property

The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated.

gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read.

Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO.

This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.

Which versions are affected by CVE-2026-93234?

How do I fix CVE-2026-93234?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-93234 being exploited?

There is no known exploitation of CVE-2026-93234 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-93234, DEBIAN-CVE-2026-93234, GHSA-mh3c-9rpg-gxv8, UBUNTU-CVE-2026-93234.