{"id":"CVE-2026-99007","kind":"vulnerability","aliases":["CVE-2026-99007"],"related":[],"title":"Linux DRM fbdev: failed probe leaves a stale mode that triggers a kernel warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN\n\n__drm_fb_helper_initial_config_and_unlock() calls\ndrm_client_modeset_probe() first, which already fills in each\nmode_set->mode/num_connectors for every connected output, and only\nafterwards calls drm_fb_helper_single_fb_probe() to create\nfb_helper->fb and wire it into those mode_sets via\ndrm_setup_crtcs_fb().\n\nIf drm_fb_helper_single_fb_probe() fails with anything other than\n-EAGAIN (e.g. dev->driver->fbdev_probe() itself fails), the function\nbails out before drm_setup_crtcs_fb() runs and before setting\nfb_helper->deferred_setup. The client is left with mode_sets that\nhave a mode and connectors but mode_set->fb == NULL, and nothing\nmarks this fb_helper as needing a retry.\n\n__drm_fb_helper_restore_fbdev_mode_unlocked() only skips committing\nwhen fb_helper->deferred_setup is set, so a later .restore() call\n(drm_lastclose() on process exit, in this report) commits the stale\nmode_set through drm_client_modeset_commit() ->\ndrm_client_modeset_commit_atomic() -> __drm_atomic_helper_set_config(),\nwhich hits WARN_ON(!set->fb).\n\nMark fb_helper->deferred_setup on any drm_fb_helper_single_fb_probe()\nfailure, not just -EAGAIN, so restore keeps skipping the commit until\na later hotplug event successfully re-probes and re-populates\nmode_set->fb. The real error code is still returned to the caller\nunchanged.","summary":"When the framebuffer helper's probe fails with an error other than EAGAIN, the kernel keeps a half-built mode configuration and later commits it on process exit, hitting a WARN_ON. The fix defers setup on any probe failure so the stale configuration is skipped until a successful re-probe.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","infrastructure","linux-kernel"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:50+00:00","updated_at":"2026-10-25T04:55:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:55:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux DRM fbdev: failed probe leaves a stale mode that triggers a kernel warning","impact":"low","summary":"When the framebuffer helper's probe fails with an error other than EAGAIN, the kernel keeps a half-built mode configuration and later commits it on process exit, hitting a WARN_ON. The fix defers setup on any probe failure so the stale configuration is skipped until a successful re-probe.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","drm"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel WARN_ON triggered during process exit or driver restore","analyst_note":"Sources give only the NVD record and kernel commit text; check the kernel stable advisories for affected version ranges and whether the WARN_ON is only a warning or a crash path.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000576,"input_tokens":3818,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-99007':17A,20A 'afterward':127C 'alreadi':114C 'anyth':161C 'atom':261C,263C 'bail':174C 'built':45B 'call':107C,128C,238C 'caller':321C 'client':109C,190C,254C,258C 'code':315C 'commit':50B,226C,247C,256C,260C,295C 'config':104C,266C 'configur':47B,70B 'connect':123C 'connector':201C 'creat':136C 'crtcs':150C,179C 'cve':15A,18A 'defer':61B,90C,187C,230C,276C 'dev':166C 'driver':167C 'drm':2A,21B,100C,108C,129C,148C,153C,177C,217C,239C,253C,257C,262C,280C 'drm/fb-helper':89C 'e.g':165C 'eagain':38B,99C,164C,289C 'error':35B,314C 'event':300C 'everi':122C 'exit':54B,243C 'fail':4A,32B,95C,159C,171C 'failur':66B,286C 'fb':101C,130C,133C,137C,139C,151C,154C,157C,180C,185C,205C,211C,218C,228C,272C,274C,281C,284C,311C 'fbdev':3A,93C,168C,221C 'fill':115C 'first':112C 'fix':60B 'follow':84C 'framebuff':28B 'function':173C 'half':44B 'half-built':43B 'helper':29B,102C,131C,138C,155C,186C,212C,219C,229C,264C,275C,282C 'hit':55B,268C 'hotplug':299C 'infrastructur':22B 'initi':103C 'keep':41B,292C 'kernel':13A,25B,40B,82C 'lastclos':240C 'later':49B,236C,298C 'leav':6A 'left':192C 'linux':1A,24B,81C 'linux-kernel':23B 'mark':209C,273C 'mode':9A,46B,118C,145C,194C,199C,203C,222C,250C,309C 'mode/num_connectors':120C 'modeset':110C,255C,259C 'need':214C 'noth':208C 'null':206C 'output':124C 'popul':308C 'probe':5A,31B,65B,78B,94C,111C,134C,158C,169C,285C,304C 'process':53B,242C 're':77B,303C,307C 're-popul':306C 're-prob':76B,302C 'real':313C 'report':246C 'resolv':88C 'restor':220C,237C,291C 'retri':216C 'return':318C 'run':181C 'set':119C,146C,184C,195C,204C,233C,251C,265C,271C,310C 'setup':62B,91C,149C,178C,188C,231C,277C 'singl':132C,156C,283C 'skip':72B,225C,293C 'stale':8A,69B,249C 'still':317C 'success':75B,301C 'trigger':11A 'unchang':322C 'unlock':106C,223C 'via':147C 'vulner':85C 'warn':14A,57B,269C 'wire':141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99007","severity":null,"published_at":"2026-10-23T13:17:23+00:00","modified_at":"2026-10-23T13:17:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}