CVE-2026-98523 - Vulnerability Details

- drm/client: fix restore of partially initialized client

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/client: fix restore of partially initialized client

I got a null-ptr-deref report when closing a DRM file descriptor:

WARNING: drivers/gpu/drm/drm_atomic.c:2031 at
__drm_atomic_helper_set_config+0x18e/0x1b0 [drm]

Call Trace:
drm_client_modeset_commit_atomic+0x16b/0x220 [drm]
drm_client_modeset_commit_locked+0x56/0x160 [drm]
drm_client_modeset_commit+0x21/0x40 [drm]
__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b/0x80
drm_fbdev_client_restore+0xe/0x20 [drm_client_lib]
drm_client_dev_restore+0x9f/0xc0 [drm]
drm_release+0xc5/0xe0 [drm]

The warning is followed by a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000008

RIP:
__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41/0x80
[drm_kms_helper]

Call Trace:
drm_fbdev_client_restore+0xe/0x20 [drm_client_lib]
drm_client_dev_restore+0x9f/0xc0 [drm]
drm_release+0xc5/0xe0 [drm]
__fput+0xdc/0x2b0
__x64_sys_close+0x39/0x80
do_syscall_64+0x8d/0x460
entry_SYSCALL_64_after_hwframe+0x76/0x7e

drm_client_register() adds the DRM client to the device client list
before invoking the initial hotplug callback. If the hotplug callback
fails, the client remains registered.

For the fbdev client, a failure during drm_fb_helper_initial_config()
causes the partially initialized fbdev helper to be cleaned up.
drm_fb_helper_fini() releases fb_helper->info and leaves it NULL.

The fbdev client therefore remains registered even though there is no
fully initialized framebuffer device.

Later, when userspace closes the DRM file descriptor, drm_release()
can invoke the restore callbacks of registered DRM clients:

drm_release()
drm_client_dev_restore()
drm_fbdev_client_restore()
drm_fb_helper_restore_fbdev_mode_unlocked()

drm_fbdev_client_restore() currently restores the fbdev state
unconditionally. For a partially initialized fbdev client this can
submit an incomplete modeset state and subsequently access fbdev
state which has not been initialized, resulting in the warning and
NULL pointer dereference above.

drm_fbdev_client_unregister() already uses fb_helper->info to
distinguish a fully probed framebuffer device from a partially
initialized client.

Use the same condition in drm_fbdev_client_restore() and skip restore
if no framebuffer device has been successfully initialized.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference in the Linux kernel’s DRM subsystem can trigger a kernel crash when a DRM client that was only partially initialized is later restored. The bug occurs after a user‑space process closes a DRM file descriptor; the restore routine unconditionally accesses framebuffer state that has not been initialized, leading to a NULL dereference and a kernel panic. The crash results in a denial of service for the affected system.

Affected Systems

All Linux distributions that run a kernel prior to the inclusion of the patch referred to by commit 11edd5b6735d2e1069ddce672b1836713647f7fb and its subsequent merges are affected. The advisory lists the generic Linux vendor, indicating that any unpatched kernel implementation is vulnerable.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity. The EPSS score is less than 1 %, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local access or the ability to trigger the close of a DRM file descriptor on the affected system, and there is no evidence of remote exploitation. The overall risk profile is a low‑probability, local denial of service rather than a confirmed remote attack vector.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7f5535fcbba2ce7f1908ee7e5c350032a4b1e9d0`	affected	< 11edd5b6735d2e1069ddce672b1836713647f7fb
`5d08c44e47b9d41366714552bdd374ac4b595591`	affected	< fcbedba553a9c430079ee225df2dc7ab556a2f83
`5d08c44e47b9d41366714552bdd374ac4b595591`	affected	< a69c4b678db808c0d89abb8cedeaaac38d1ef182
`5d08c44e47b9d41366714552bdd374ac4b595591`	affected	< 1fca688e9443003e33cf30453e7a7560367656c9
`6.12.19`	affected	< 6.12.112

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7f5535fcbba2ce7f1908ee7e5c350032a4b1e9d0,11edd5b6735d2e1069ddce672b1836713647f7fb)`	affected	code_commit	—
`[5d08c44e47b9d41366714552bdd374ac4b595591,fcbedba553a9c430079ee225df2dc7ab556a2f83)`	affected	code_commit	—
`[5d08c44e47b9d41366714552bdd374ac4b595591,a69c4b678db808c0d89abb8cedeaaac38d1ef182)`	affected	code_commit	—
`[5d08c44e47b9d41366714552bdd374ac4b595591,1fca688e9443003e33cf30453e7a7560367656c9)`	affected	code_commit	—
`[6.12.19,6.12.112)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.13`	affected	semver	—
`[0,6.13)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel release that contains the drm/client restore patch associated with commit 11edd5b6735d2e1069ddce672b1836713647f7fb and all following merges.
If a kernel upgrade cannot be performed immediately, disable the legacy fbdev DRM path to avoid the restore routine that can trigger the null pointer dereference.
Subscribe to distribution security advisories and install future updates that address DRM or framebuffer handling concerns.

Generated by OpenCVE AI on October 20, 2026 at 19:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98523.mbox
https://git.kernel.org/stable/c/11edd5b6735d2e1069ddce672b1836713647f7fb
https://git.kernel.org/stable/c/1fca688e9443003e33cf30453e7a7560367656c9
https://git.kernel.org/stable/c/a69c4b678db808c0d89abb8cedeaaac38d1ef182
https://git.kernel.org/stable/c/fcbedba553a9c430079ee225df2dc7ab556a2f83
https://nvd.nist.gov/vuln/detail/CVE-2026-98523
https://www.cve.org/CVERecord?id=CVE-2026-98523

History

Tue, 20 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Tue, 20 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98523.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98523 https://www.cve.org/CVERecord?id=CVE-2026-98523
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-665

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm_atomic.c:2031 at __drm_atomic_helper_set_config+0x18e/0x1b0 [drm] Call Trace: drm_client_modeset_commit_atomic+0x16b/0x220 [drm] drm_client_modeset_commit_locked+0x56/0x160 [drm] drm_client_modeset_commit+0x21/0x40 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b/0x80 drm_fbdev_client_restore+0xe/0x20 [drm_client_lib] drm_client_dev_restore+0x9f/0xc0 [drm] drm_release+0xc5/0xe0 [drm] The warning is followed by a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41/0x80 [drm_kms_helper] Call Trace: drm_fbdev_client_restore+0xe/0x20 [drm_client_lib] drm_client_dev_restore+0x9f/0xc0 [drm] drm_release+0xc5/0xe0 [drm] __fput+0xdc/0x2b0 __x64_sys_close+0x39/0x80 do_syscall_64+0x8d/0x460 entry_SYSCALL_64_after_hwframe+0x76/0x7e drm_client_register() adds the DRM client to the device client list before invoking the initial hotplug callback. If the hotplug callback fails, the client remains registered. For the fbdev client, a failure during drm_fb_helper_initial_config() causes the partially initialized fbdev helper to be cleaned up. drm_fb_helper_fini() releases fb_helper->info and leaves it NULL. The fbdev client therefore remains registered even though there is no fully initialized framebuffer device. Later, when userspace closes the DRM file descriptor, drm_release() can invoke the restore callbacks of registered DRM clients: drm_release() drm_client_dev_restore() drm_fbdev_client_restore() drm_fb_helper_restore_fbdev_mode_unlocked() drm_fbdev_client_restore() currently restores the fbdev state unconditionally. For a partially initialized fbdev client this can submit an incomplete modeset state and subsequently access fbdev state which has not been initialized, resulting in the warning and NULL pointer dereference above. drm_fbdev_client_unregister() already uses fb_helper->info to distinguish a fully probed framebuffer device from a partially initialized client. Use the same condition in drm_fbdev_client_restore() and skip restore if no framebuffer device has been successfully initialized.
Title		drm/client: fix restore of partially initialized client
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/11edd5b6735d2e1069ddce672b1836713647f7fb https://git.kernel.org/stable/c/1fca688e9443003e33cf30453e7a7560367656c9 https://git.kernel.org/stable/c/a69c4b678db808c0d89abb8cedeaaac38d1ef182 https://git.kernel.org/stable/c/fcbedba553a9c430079ee225df2dc7ab556a2f83

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:17:40.598Z

Updated: 2026-10-19T09:21:05.087Z

Reserved: 2026-09-25T10:25:14.355Z

Link: CVE-2026-98523

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:03.700

Modified: 2026-10-19T10:19:07.417

Link: CVE-2026-98523

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98523 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T20:00:15Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object