CVE-2026-98148

A flaw was found in the Linux kernel's Generic USB Display (GUD) driver. This vulnerability can lead to a Denial of Service (DoS) if an attacker connects a malicious USB display device to the system. The driver fails to verify that the default display rotation capability is present in the device's reported configuration before registering display properties. This omission triggers an internal kernel warning assertion, which can lead to a system crash on systems configured to halt on kernel warnings.

A low-severity denial-of-service flaw was found in the Linux kernel's Generic USB Display (GUD) driver. The driver does not validate that the required GUD_ROTATION_0 bit is present in the rotation bitmask reported by a USB display device before creating the plane rotation property. A malicious or malformed USB display device that omits this bit triggers a WARN_ON assertion in drm_plane_create_rotation_property(), which can crash systems configured to halt on kernel warnings. Because exploitation requires connecting a malicious USB display device to the system and the impact is limited to availability, Red Hat rates the impact of this flaw as Low, even though the CVSS:3.1 base score of 5.5 (Moderate) reflects the high availability impact on such configurations.

The vulnerable code is present in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 (4.13 and later, including 5.x). Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (RHEL CoreOS 8), do not contain the vulnerable code and are therefore not affected. Given the low severity of this flaw, the fix has been deferred for the affected streams, which therefore remain vulnerable; the residual risk is a local denial of service from a physically attached malicious USB display device, limited to a kernel warning on systems that are not configured to panic on warnings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

On systems where halting on kernel warnings is not required, verify that panic_on_warn is disabled (kernel.panic_on_warn=0); this prevents the WARN_ON triggered by a malicious USB display device from causing a system crash, reducing the impact to a kernel warning. Restricting physical access and avoiding untrusted USB display devices further limits exposure to this issue.