CVE-2026-98973

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: Fix unlocked list del in drm bridge add()

When re-adding a bridge that was previously removed, drm bridge add() drops it from bridge lingering list without holding bridge lock.

Both bridge list and bridge lingering list are protected by bridge lock, as they are concurrently modified by drm bridge remove() and drm bridge free(), and walked by the debugfs 'bridges' file. Running the list empty() test and the list del init() outside of the lock may therefore corrupt either list.

Perform both under bridge lock.