CVE-2026-89817

A flaw was found in the Linux kernel's drm/gud component. The gud_connector_add_tv_mode() function reads TV mode names from a USB device. These names are not guaranteed to be null-terminated, which can cause the system to read beyond the allocated buffer when processing them. This out-of-bounds read could lead to information disclosure or a denial of service.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires physical access or host USB redirection to attach a specially crafted USB display device. The out-of-bounds memory read occurs only during device initialization when parsing display mode properties, limiting the primary impact to a local kernel crash resulting in denial of service. Standard enterprise server configurations rarely employ Generic USB Display hardware, significantly reducing overall exposure in typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.