CVE-2026-89817

gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drm_mode_create_tv_properties_legacy(), which calls strlen() on each one. Nothing guarantees the device NUL-terminates a name, so strlen() can run past the end of a slot and, for the last mode, past the end of the allocation.

Terminate each name at the end of its slot before use.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89817.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

40e1a70b4aedf2859a1829991b48ef0ebe650bf2

Fixed

08c8ec28547987e55a90c662f8795e05c2925498

Fixed

9096edfd6f2edbc79612b482547e0972edbcfe4b

Fixed

89210cb5ff8fdbe055c97ac688be2268f6c815ae

Fixed

d0f3312f7800eb0e00d1264f66104c788f43dd69

Fixed

b86438a5c6b0250ccb07dd380184d1e70e0dea6c

Fixed

6ea61f1d4cbaa0db937e31bffc041fb8afeacf52

Fixed

500cb24cd61bad8a2747ddfc49b7034899c82d94

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89817.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.13.0

Fixed

5.15.221

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.188

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.157

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.110

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.51

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.2.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89817.json"