CVE-2026-93234

A flaw was found in the Linux kernel's Generic USB Display (GUD) driver. When reading television mode names from an attached device, the driver does not verify that the returned data contains a terminating null byte within its fixed-size buffer. A local attacker could attach a crafted device to cause an out-of-bounds memory read, leading to a system crash and Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having a Low severity impact because successful exploitation requires attaching a crafted USB display device to the target system, restricting the attack vector to environments with physical access or virtualized USB pass-through. Although the out-of-bounds read can trigger a kernel panic resulting in a denial of service, it does not allow arbitrary code execution or data modification. Enterprise server deployments typically do not utilize USB-connected displays, further reducing the overall risk in production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.