Vulnerability in Linux kernel impacting device rotation handling

CVE-2026-98148

What is CVE-2026-98148?

A vulnerability exists in the Linux kernel where the rotation argument intended for drm_plane_create_rotation_property() is not properly validated. Specifically, the argument is set to DRM_MODE_ROTATE_0, yet the device's rotation bitmask (supported_rotations) is not checked for the presence of GUD_ROTATION_0. This oversight can lead to a situation where a device lacking the GUD_ROTATION_0 bit inadvertently triggers a warning during property creation. The resolution involves modifying the driver's logic to ensure that the creation of the rotation property is skipped if GUD_ROTATION_0 is missing from the device, thus preventing potential instability.

References