CVE-2026-98523: drm/client: fix restore of partially initialized client
In the Linux kernel, the following vulnerability has been resolved:
drm/client: fix restore of partially initialized client
I got a null-ptr-deref report when closing a DRM file descriptor:
WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 [drm]
Call Trace: drmclientmodesetcommitatomic+0x16b/0x220 [drm] drmclientmodesetcommitlocked+0x56/0x160 [drm] drmclientmodesetcommit+0x21/0x40 [drm] drmfbhelperrestorefbdevmodeunlocked.part.0+0x7b/0x80 drmfbdevclientrestore+0xe/0x20 [drmclientlib] drmclientdevrestore+0x9f/0xc0 [drm] drmrelease+0xc5/0xe0 [drm]
The warning is followed by a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: drmfbhelperrestorefbdevmodeunlocked.part.0+0x41/0x80 [drmkmshelper]
Call Trace: drmfbdevclientrestore+0xe/0x20 [drmclientlib] drmclientdevrestore+0x9f/0xc0 [drm] drmrelease+0xc5/0xe0 [drm] fput+0xdc/0x2b0 x64sysclose+0x39/0x80 dosyscall64+0x8d/0x460 entrySYSCALL64afterhwframe+0x76/0x7e
drmclientregister() adds the DRM client to the device client list before invoking the initial hotplug callback. If the hotplug callback fails, the client remains registered.
For the fbdev client, a failure during drmfbhelperinitialconfig() causes the partially initialized fbdev helper to be cleaned up. drmfbhelperfini() releases fbhelper->info and leaves it NULL.
The fbdev client therefore remains registered even though there is no fully initialized framebuffer device.
Later, when userspace closes the DRM file descriptor, drmrelease() can invoke the restore callbacks of registered DRM clients:
drmrelease() drmclientdevrestore() drmfbdevclientrestore() drmfbhelperrestorefbdevmodeunlocked()
drmfbdevclientrestore() currently restores the fbdev state unconditionally. For a partially initialized fbdev client this can submit an incomplete modeset state and subsequently access fbdev state which has not been initialized, resulting in the warning and NULL pointer dereference above.
drmfbdevclientunregister() already uses fbhelper->info to distinguish a fully probed framebuffer device from a partially initialized client.
Use the same condition in drmfbdevclientrestore() and skip restore if no framebuffer device has been successfully initialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm_fbdev_client_restore(), check whether a framebuffer device was successfully initialized before restoring fbdev state; skip the restore when the client is only partially initialized or fb_helper->info is NULL.