{"id":"CVE-2026-99007","summary":"drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN\n\n__drm_fb_helper_initial_config_and_unlock() calls\ndrm_client_modeset_probe() first, which already fills in each\nmode_set-\u003emode/num_connectors for every connected output, and only\nafterwards calls drm_fb_helper_single_fb_probe() to create\nfb_helper-\u003efb and wire it into those mode_sets via\ndrm_setup_crtcs_fb().\n\nIf drm_fb_helper_single_fb_probe() fails with anything other than\n-EAGAIN (e.g. dev-\u003edriver-\u003efbdev_probe() itself fails), the function\nbails out before drm_setup_crtcs_fb() runs and before setting\nfb_helper-\u003edeferred_setup. The client is left with mode_sets that\nhave a mode and connectors but mode_set-\u003efb == NULL, and nothing\nmarks this fb_helper as needing a retry.\n\n__drm_fb_helper_restore_fbdev_mode_unlocked() only skips committing\nwhen fb_helper-\u003edeferred_setup is set, so a later .restore() call\n(drm_lastclose() on process exit, in this report) commits the stale\nmode_set through drm_client_modeset_commit() -\u003e\ndrm_client_modeset_commit_atomic() -\u003e __drm_atomic_helper_set_config(),\nwhich hits WARN_ON(!set-\u003efb).\n\nMark fb_helper-\u003edeferred_setup on any drm_fb_helper_single_fb_probe()\nfailure, not just -EAGAIN, so restore keeps skipping the commit until\na later hotplug event successfully re-probes and re-populates\nmode_set-\u003efb. The real error code is still returned to the caller\nunchanged.","modified":"2026-11-04T14:27:31.081036347Z","published":"2026-10-23T12:20:32.381Z","related":["SUSE-SU-2026:5091-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99007.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3b303696f61461b3569019d7fcac6a646652b2b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/423c871a586cff8b29f48db00e3c45c21d0e8121"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4a2006c675758f0c765b36fec6b49d17e89159cf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4e7b508c7c60dec7a86b7eb2a1b7e6d174afa457"},{"type":"WEB","url":"https://git.kernel.org/stable/c/755c94d178b7e972bb766199d34e4ba4f63a89eb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9124411cb91b129ff3ffb0d723ecba7a5bf893f9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d510ed273854177f0a3ed330145858b2fe667f81"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e5f8f6e0f0a18c77c04b757d72319d897a0b4bc1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99007.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99007"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ca91a2758fcef6635626993557dd51cfbb6dd134"},{"fixed":"423c871a586cff8b29f48db00e3c45c21d0e8121"},{"fixed":"e5f8f6e0f0a18c77c04b757d72319d897a0b4bc1"},{"fixed":"9124411cb91b129ff3ffb0d723ecba7a5bf893f9"},{"fixed":"4a2006c675758f0c765b36fec6b49d17e89159cf"},{"fixed":"3b303696f61461b3569019d7fcac6a646652b2b4"},{"fixed":"4e7b508c7c60dec7a86b7eb2a1b7e6d174afa457"},{"fixed":"d510ed273854177f0a3ed330145858b2fe667f81"},{"fixed":"755c94d178b7e972bb766199d34e4ba4f63a89eb"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99007.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"5.10.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.224"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99007.json"}}],"schema_version":"1.9.2"}