Linux kernel (drm/gud) CVE-2026-98148

Exploitation requires attaching a GUD-protocol USB display device whose GUD_PROPERTY_ROTATION bitmask does not include the GUD_ROTATION_0 bit, and the gud driver (CONFIG_DRM_GUD) must be built into or loadable by the running kernel so it binds to the device. Limiting factors that reduce realistic risk: the attacker needs local/physical ability to connect USB hardware running custom/malicious firmware; the niche gud module must be present and active; and the WARN_ON only causes an actual system halt (true availability impact) when the kernel is configured with panic_on_warn - on default configurations it produces only a log warning rather than a crash.

This is a low-priority, defense-in-depth kernel hardening fix rather than an urgent security issue, and the signals largely agree. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) scores confidentiality and integrity as none and only availability as high, which is consistent with a WARN_ON()-triggered denial of service and NOT with the 'Information Disclosure' tag in the input - that tag contradicts C:N and appears mislabeled. EPSS is 0.15% (4th percentile), i.e. very low predicted exploitation, there is no CISA KEV listing and no PoC or exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which aligns with routine patching rather than emergency action. Two caveats to flag explicitly: (1) the vector states AV:L, but the actual trigger is a malicious/malformed GUD-protocol USB display device, which in practice implies local/physical hardware access - verify the intended attack vector against the device model. (2) The A:H rating assumes the warning escalates to a crash; a WARN_ON only halts the system when the kernel is built/booted with panic_on_warn, otherwise it produces only a log splat, so real-world availability impact on default configurations is lower than A:H suggests.

An attacker with the ability to attach USB hardware connects a malicious or malformed GUD (USB display) device whose reported GUD_PROPERTY_ROTATION bitmask omits the GUD_ROTATION_0 bit. When the gud driver probes the device it passes the unvalidated bitmask to drm_plane_create_rotation_property(), tripping the WARN_ON(rotation & ~supported_rotations) check; on a kernel configured with panic_on_warn this becomes a denial of service. No public exploit was identified at the time of analysis.