{"id":"CVE-2026-98523","kind":"vulnerability","aliases":["CVE-2026-98523"],"related":[],"title":"Linux kernel DRM: partially initialized fbdev client crashes on file close","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: fix restore of partially initialized client\n\nI got a null-ptr-deref report when closing a DRM file descriptor:\n\nWARNING: drivers/gpu/drm/drm_atomic.c:2031 at\n__drm_atomic_helper_set_config+0x18e/0x1b0 [drm]\n\nCall Trace:\ndrm_client_modeset_commit_atomic+0x16b/0x220 [drm]\ndrm_client_modeset_commit_locked+0x56/0x160 [drm]\ndrm_client_modeset_commit+0x21/0x40 [drm]\n__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b/0x80\ndrm_fbdev_client_restore+0xe/0x20 [drm_client_lib]\ndrm_client_dev_restore+0x9f/0xc0 [drm]\ndrm_release+0xc5/0xe0 [drm]\n\nThe warning is followed by a NULL pointer dereference:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n\nRIP:\n__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41/0x80\n[drm_kms_helper]\n\nCall Trace:\ndrm_fbdev_client_restore+0xe/0x20 [drm_client_lib]\ndrm_client_dev_restore+0x9f/0xc0 [drm]\ndrm_release+0xc5/0xe0 [drm]\n__fput+0xdc/0x2b0\n__x64_sys_close+0x39/0x80\ndo_syscall_64+0x8d/0x460\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\ndrm_client_register() adds the DRM client to the device client list\nbefore invoking the initial hotplug callback. If the hotplug callback\nfails, the client remains registered.\n\nFor the fbdev client, a failure during drm_fb_helper_initial_config()\ncauses the partially initialized fbdev helper to be cleaned up.\ndrm_fb_helper_fini() releases fb_helper->info and leaves it NULL.\n\nThe fbdev client therefore remains registered even though there is no\nfully initialized framebuffer device.\n\nLater, when userspace closes the DRM file descriptor, drm_release()\ncan invoke the restore callbacks of registered DRM clients:\n\ndrm_release()\ndrm_client_dev_restore()\ndrm_fbdev_client_restore()\ndrm_fb_helper_restore_fbdev_mode_unlocked()\n\ndrm_fbdev_client_restore() currently restores the fbdev state\nunconditionally. For a partially initialized fbdev client this can\nsubmit an incomplete modeset state and subsequently access fbdev\nstate which has not been initialized, resulting in the warning and\nNULL pointer dereference above.\n\ndrm_fbdev_client_unregister() already uses fb_helper->info to\ndistinguish a fully probed framebuffer device from a partially\ninitialized client.\n\nUse the same condition in drm_fbdev_client_restore() and skip restore\nif no framebuffer device has been successfully initialized.","summary":"When the initial framebuffer setup of the DRM fbdev client fails, the client stays registered, and closing the DRM file descriptor then restores a framebuffer that was never initialized. The result is a kernel warning and a NULL pointer dereference, which crashes the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","graphics","linux-kernel","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:10+00:00","updated_at":"2026-10-25T05:25:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:25:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel DRM: partially initialized fbdev client crashes on file close","impact":"low","summary":"When the initial framebuffer setup of the DRM fbdev client fails, the client stays registered, and closing the DRM file descriptor then restores a framebuffer that was never initialized. The result is a kernel warning and a NULL pointer dereference, which crashes the kernel.","category":"package","nicknames":[],"who_cares":["linux-kernel","drm","graphics"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel crashes with NULL pointer dereference on file close","analyst_note":"Find the fixed kernel versions and stable backport commits for the drm/client restore fix in the kernel git tree or NVD entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the DRM subsystem and the fbdev client, where the initial framebuffer configuration fails. The sources do not say which kernel versions are fixed, so unknown. Hosts without a graphics driver loaded, and servers without a display stack, are unlikely to be affected, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":4267,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':108C,118C,126C,133C,138C,144C,153C,158C,180C,191C,200C,205C,209C,214C,219C,226C '-2026':13A,16A '-98523':14A,17A '0':137C,179C '0000000000000008':176C '2031':101C '64':218C,223C 'access':365C 'add':231C 'address':175C 'alreadi':386C 'atom':104C,117C 'bug':170C 'call':111C,185C 'callback':245C,249C,318C 'caus':267C 'clean':275C 'client':7A,33B,36B,84C,114C,122C,130C,142C,147C,150C,189C,194C,197C,229C,234C,238C,252C,258C,291C,322C,326C,331C,342C,355C,384C,402C,410C 'close':11A,40B,94C,213C,307C 'commit':116C,124C,132C 'condit':406C 'config':107C,266C 'crash':8A,65B 'current':344C 'cve':12A,15A 'deref':91C 'derefer':63B,169C,174C,380C 'descriptor':44B,98C,311C 'dev':151C,198C,327C 'devic':237C,303C,397C,418C 'distinguish':392C 'drivers/gpu/drm/drm_atomic.c':100C 'drm':3A,18B,31B,42B,96C,103C,110C,113C,120C,121C,128C,129C,135C,140C,146C,149C,155C,156C,160C,182C,187C,193C,196C,202C,203C,207C,228C,233C,262C,277C,309C,312C,321C,323C,325C,329C,333C,340C,382C,408C 'drm/client':78C 'drm_fb_helper_restore_fbdev_mode_unlocked.part':136C,178C 'entri':221C 'even':295C 'fail':34B,250C 'failur':260C 'fb':263C,278C,282C,334C,388C 'fbdev':6A,32B,141C,188C,257C,271C,290C,330C,337C,341C,347C,354C,366C,383C,409C 'file':10A,43B,97C,310C 'fini':280C 'fix':79C 'follow':73C,164C 'fput':208C 'framebuff':27B,48B,302C,396C,417C 'fulli':300C,394C 'got':86C 'graphic':19B 'helper':105C,184C,264C,272C,279C,283C,335C,389C 'hotplug':244C,248C 'hwframe':225C 'incomplet':360C 'info':284C,390C 'initi':5A,26B,52B,83C,243C,265C,270C,301C,353C,372C,401C,422C 'invok':241C,315C 'kernel':2A,22B,57B,67B,71C,171C 'kms':183C 'later':304C 'leav':286C 'lib':148C,195C 'linux':1A,21B,70C 'linux-kernel':20B 'list':239C 'lock':125C 'mode':338C 'modeset':115C,123C,131C,361C 'never':51B 'null':61B,89C,167C,172C,288C,378C 'null-ptr-deref':88C 'packag':23B 'partial':4A,82C,269C,352C,400C 'pointer':62B,168C,173C,379C 'probe':395C 'ptr':90C 'regist':38B,230C,254C,294C,320C 'releas':157C,204C,281C,313C,324C 'remain':253C,293C 'report':92C 'resolv':77C 'restor':46B,80C,143C,152C,190C,199C,317C,328C,332C,336C,343C,345C,411C,414C 'result':54B,373C 'rip':177C 'set':106C 'setup':28B 'skip':413C 'state':348C,362C,367C 'stay':37B 'submit':358C 'subsequ':364C 'success':421C 'sys':212C 'syscal':217C,222C 'therefor':292C 'though':296C 'trace':112C,186C 'uncondit':349C 'unlock':339C 'unregist':385C 'use':387C,403C 'userspac':306C 'vulner':74C 'warn':58B,99C,162C,376C 'x16b/0x220':119C 'x18e/0x1b0':109C 'x21/0x40':134C 'x39/0x80':215C 'x41/0x80':181C 'x56/0x160':127C 'x64':211C 'x76/0x7e':227C 'x7b/0x80':139C 'x8d/0x460':220C 'x9f/0xc0':154C,201C 'xc5/0xe0':159C,206C 'xdc/0x2b0':210C 'xe/0x20':145C,192C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the DRM subsystem and the fbdev client, where the initial framebuffer configuration fails. The sources do not say which kernel versions are fixed, so unknown. Hosts without a graphics driver loaded, and servers without a display stack, are unlikely to be affected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98523","severity":null,"published_at":"2026-10-18T16:17:03+00:00","modified_at":"2026-10-19T10:19:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}