CVE-2026-98523

In the Linux kernel, the following vulnerability has been resolved:

drm/client: fix restore of partially initialized client

I got a null-ptr-deref report when closing a DRM file descriptor:

WARNING: drivers/gpu/drm/drm atomic.c:2031 at drm atomic helper set config+0x18e/0x1b0 [drm]

Call Trace: drm client modeset commit atomic+0x16b/0x220 [drm] drm client modeset commit locked+0x56/0x160 [drm] drm client modeset commit+0x21/0x40 [drm] drm fb helper restore fbdev mode unlocked.part.0+0x7b/0x80 drm fbdev client restore+0xe/0x20 [drm client lib] drm client dev restore+0x9f/0xc0 [drm] drm release+0xc5/0xe0 [drm]

The warning is followed by a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000008

RIP: drm fb helper restore fbdev mode unlocked.part.0+0x41/0x80 [drm kms helper]

Call Trace: drm fbdev client restore+0xe/0x20 [drm client lib] drm client dev restore+0x9f/0xc0 [drm] drm release+0xc5/0xe0 [drm] fput+0xdc/0x2b0 x64 sys close+0x39/0x80 do syscall 64+0x8d/0x460 entry SYSCALL 64 after hwframe+0x76/0x7e

drm client register() adds the DRM client to the device client list before invoking the initial hotplug callback. If the hotplug callback fails, the client remains registered.

For the fbdev client, a failure during drm fb helper initial config() causes the partially initialized fbdev helper to be cleaned up. drm fb helper fini() releases fb helper->info and leaves it NULL.

The fbdev client therefore remains registered even though there is no fully initialized framebuffer device.

Later, when userspace closes the DRM file descriptor, drm release() can invoke the restore callbacks of registered DRM clients:

drm release() drm client dev restore() drm fbdev client restore() drm fb helper restore fbdev mode unlocked()

drm fbdev client restore() currently restores the fbdev state unconditionally. For a partially initialized fbdev client this can submit an incomplete modeset state and subsequently access fbdev state which has not been initialized, resulting in the warning and NULL pointer dereference above.

drm fbdev client unregister() already uses fb helper->info to distinguish a fully probed framebuffer device from a partially initialized client.

Use the same condition in drm fbdev client restore() and skip restore if no framebuffer device has been successfully initialized.