CVE-2026-98973: drm/bridge: Fix unlocked list_del in drm_bridge_add()
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: Fix unlocked listdel in drmbridgeadd()
When re-adding a bridge that was previously removed, drmbridgeadd() drops it from bridgelingeringlist without holding bridgelock.
Both bridgelist and bridgelingeringlist are protected by bridgelock, as they are concurrently modified by drmbridgeremove() and drmbridgefree(), and walked by the debugfs 'bridges' file. Running the listempty() test and the listdelinit() outside of the lock may therefore corrupt either list.
Perform both under bridgelock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm_bridge_add(), perform the list_empty() test and list_del_init() on bridge_lingering_list while holding bridge_lock, so both bridge_list and bridge_lingering_list operations are protected by the lock.