CVE-2026-98523
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
drm/client: corregir la restauración de un cliente parcialmente inicializado
Al cerrar un descriptor de archivo de DRM recibí un informe de desreferencia de puntero nulo:
A la advertencia le sigue una desreferencia de puntero NULL:
drm_client_register() añade el cliente de DRM a la lista de clientes del dispositivo antes de invocar el callback inicial de hotplug. Si ese callback falla, el cliente permanece registrado.
En el caso del cliente fbdev, un fallo durante drm_fb_helper_initial_config() provoca que el helper fbdev parcialmente inicializado se limpie. drm_fb_helper_fini() libera fb_helper->info y lo deja a NULL.
Leer descripción completaMostrar menos
Por tanto, el cliente fbdev permanece registrado aunque no exista ningún dispositivo de framebuffer completamente inicializado.
Más tarde, cuando el espacio de usuario cierra el descriptor de archivo de DRM, drm_release() puede invocar los callbacks de restauración de los clientes de DRM registrados:
drm_release() drm_client_dev_restore() drm_fbdev_client_restore() drm_fb_helper_restore_fbdev_mode_unlocked()
drm_fbdev_client_restore() restaura actualmente el estado de fbdev de forma incondicional. En un cliente fbdev parcialmente inicializado, esto puede enviar un estado de modeset incompleto y, después, acceder a un estado de fbdev que no se ha inicializado, lo que provoca la advertencia y la desreferencia de puntero NULL anteriores.
drm_fbdev_client_unregister() ya utiliza fb_helper->info para distinguir un dispositivo de framebuffer completamente sondeado de un cliente parcialmente inicializado.
Usa la misma condición en drm_fbdev_client_restore() y omite la restauración si no se ha inicializado correctamente ningún dispositivo de framebuffer.
Detalles técnicos trazas, registros y código del informe original
WARNING: drivers/gpu/drm/drm_atomic.c:2031 at __drm_atomic_helper_set_config+0x18e/0x1b0 [drm] Call Trace: drm_client_modeset_commit_atomic+0x16b/0x220 [drm] drm_client_modeset_commit_locked+0x56/0x160 [drm] drm_client_modeset_commit+0x21/0x40 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b/0x80 drm_fbdev_client_restore+0xe/0x20 [drm_client_lib] drm_client_dev_restore+0x9f/0xc0 [drm] drm_release+0xc5/0xe0 [drm] BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41/0x80 [drm_kms_helper] Call Trace: drm_fbdev_client_restore+0xe/0x20 [drm_client_lib] drm_client_dev_restore+0x9f/0xc0 [drm] drm_release+0xc5/0xe0 [drm] __fput+0xdc/0x2b0 __x64_sys_close+0x39/0x80 do_syscall_64+0x8d/0x460 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 10
- Fecha de la puntuación
- 19/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98523",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7f5535fcbba2ce7f1908ee7e5c350032a4b1e9d0",
"lessThan": "11edd5b6735d2e1069ddce672b1836713647f7fb",
"versionType": "git"
},
{
"status": "affected",
"version": "5d08c44e47b9d41366714552bdd374ac4b595591",
"lessThan": "fcbedba553a9c430079ee225df2dc7ab556a2f83",
"versionType": "git"
},
{
"status": "affected",
"version": "5d08c44e47b9d41366714552bdd374ac4b595591",
"lessThan": "a69c4b678db808c0d89abb8cedeaaac38d1ef182",
"versionType": "git"
},
{
"status": "affected",
"version": "5d08c44e47b9d41366714552bdd374ac4b595591",
"lessThan": "1fca688e9443003e33cf30453e7a7560367656c9",
"versionType": "git"
},
{
"status": "affected",
"version": "6.12.19",
"lessThan": "6.12.112",
"versionType": "semver"
}
],
"programFiles": [
"drivers/gpu/drm/clients/drm_fbdev_client.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/clients/drm_fbdev_client.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:03.700",
"references": [
{
"url": "https://git.kernel.org/stable/c/11edd5b6735d2e1069ddce672b1836713647f7fb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1fca688e9443003e33cf30453e7a7560367656c9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a69c4b678db808c0d89abb8cedeaaac38d1ef182",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fcbedba553a9c430079ee225df2dc7ab556a2f83",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: fix restore of partially initialized client\n\nI got a null-ptr-deref report when closing a DRM file descriptor:\n\nWARNING: drivers/gpu/drm/drm_atomic.c:2031 at\n__drm_atomic_helper_set_config+0x18e/0x1b0 [drm]\n\nCall Trace:\ndrm_client_modeset_commit_atomic+0x16b/0x220 [drm]\ndrm_client_modeset_commit_locked+0x56/0x160 [drm]\ndrm_client_modeset_commit+0x21/0x40 [drm]\n__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b/0x80\ndrm_fbdev_client_restore+0xe/0x20 [drm_client_lib]\ndrm_client_dev_restore+0x9f/0xc0 [drm]\ndrm_release+0xc5/0xe0 [drm]\n\nThe warning is followed by a NULL pointer dereference:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n\nRIP:\n__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41/0x80\n[drm_kms_helper]\n\nCall Trace:\ndrm_fbdev_client_restore+0xe/0x20 [drm_client_lib]\ndrm_client_dev_restore+0x9f/0xc0 [drm]\ndrm_release+0xc5/0xe0 [drm]\n__fput+0xdc/0x2b0\n__x64_sys_close+0x39/0x80\ndo_syscall_64+0x8d/0x460\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\ndrm_client_register() adds the DRM client to the device client list\nbefore invoking the initial hotplug callback. If the hotplug callback\nfails, the client remains registered.\n\nFor the fbdev client, a failure during drm_fb_helper_initial_config()\ncauses the partially initialized fbdev helper to be cleaned up.\ndrm_fb_helper_fini() releases fb_helper->info and leaves it NULL.\n\nThe fbdev client therefore remains registered even though there is no\nfully initialized framebuffer device.\n\nLater, when userspace closes the DRM file descriptor, drm_release()\ncan invoke the restore callbacks of registered DRM clients:\n\ndrm_release()\ndrm_client_dev_restore()\ndrm_fbdev_client_restore()\ndrm_fb_helper_restore_fbdev_mode_unlocked()\n\ndrm_fbdev_client_restore() currently restores the fbdev state\nunconditionally. For a partially initialized fbdev client this can\nsubmit an incomplete modeset state and subsequently access fbdev\nstate which has not been initialized, resulting in the warning and\nNULL pointer dereference above.\n\ndrm_fbdev_client_unregister() already uses fb_helper->info to\ndistinguish a fully probed framebuffer device from a partially\ninitialized client.\n\nUse the same condition in drm_fbdev_client_restore() and skip restore\nif no framebuffer device has been successfully initialized."
}
],
"lastModified": "2026-10-19T10:19:07.417",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}