{"id":"CVE-2026-98973","kind":"vulnerability","aliases":["CVE-2026-98973"],"related":[],"title":"Linux kernel DRM bridge: unlocked list removal can corrupt bridge lists","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: Fix unlocked list_del in drm_bridge_add()\n\nWhen re-adding a bridge that was previously removed, drm_bridge_add()\ndrops it from bridge_lingering_list without holding bridge_lock.\n\nBoth bridge_list and bridge_lingering_list are protected by bridge_lock,\nas they are concurrently modified by drm_bridge_remove() and\n__drm_bridge_free(), and walked by the debugfs 'bridges' file.  Running\nthe list_empty() test and the list_del_init() outside of the lock may\ntherefore corrupt either list.\n\nPerform both under bridge_lock.","summary":"In the Linux kernel's DRM bridge code, re-adding a removed bridge drops it from a shared list without holding the lock that protects the list. A race with concurrent bridge removal or the debugfs listing can corrupt the kernel's internal lists.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["display","drm","infrastructure","linux-kernel"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- Move to a Linux kernel release that includes the upstream commit 'drm/bridge: Fix unlocked list_del in drm_bridge_add()'; the sources do not name the fixed version.","status":"open","published_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:24+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:56:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Linux kernel release that includes the upstream commit 'drm/bridge: Fix unlocked list_del in drm_bridge_add()'; the sources do not name the fixed version.","reach":"local","title":"Linux kernel DRM bridge: unlocked list removal can corrupt bridge lists","impact":"medium","summary":"In the Linux kernel's DRM bridge code, re-adding a removed bridge drops it from a shared list without holding the lock that protects the list. A race with concurrent bridge removal or the debugfs listing can corrupt the kernel's internal lists.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","drm","display"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel list corruption; crash or possible local privilege escalation","analyst_note":"Check the kernel.org stable commit and NVD CVSS for the fixed versions and whether the race is exploitable beyond a crash.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running a Linux kernel with the DRM bridge subsystem, typically machines with display hardware that uses bridge chips. The sources do not say which kernel versions are affected or whether a default configuration reaches the code path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":3443,"output_tokens":496,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98973':14A,17A 'add':34B,87C,91C,100C 'bridg':4A,10A,30B,37B,56B,86C,93C,99C,104C,109C,112C,115C,121C,130C,134C,141C,165C 'code':31B 'concurr':55B,126C 'corrupt':9A,63B,159C 'cve':12A,15A 'debugf':60B,140C 'del':83C,151C 'display':18B 'drm':3A,19B,29B,85C,98C,129C,133C 'drm/bridge':79C 'drop':38B,101C 'either':160C 'empti':146C 'file':142C 'fix':80C 'follow':74C 'free':135C 'hold':45B,108C 'infrastructur':20B 'init':152C 'intern':67B 'kernel':2A,23B,27B,65B,72C 'linger':105C,116C 'linux':1A,22B,26B,71C 'linux-kernel':21B 'list':6A,11A,43B,51B,61B,68B,82C,106C,113C,117C,145C,150C,161C 'lock':47B,110C,122C,156C,166C 'may':157C 'modifi':127C 'outsid':153C 'perform':162C 'previous':96C 'protect':49B,119C 'race':53B 're':33B,90C 're-ad':32B,89C 'remov':7A,36B,57B,97C,131C 'resolv':78C 'run':143C 'share':42B 'test':147C 'therefor':158C 'unlock':5A,81C 'vulner':75C 'walk':137C 'without':44B,107C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the DRM bridge subsystem, typically machines with display hardware that uses bridge chips. The sources do not say which kernel versions are affected or whether a default configuration reaches the code path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98973","severity":null,"published_at":"2026-10-23T13:17:18+00:00","modified_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98973","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98973","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}