In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref… (CVE-2026-98523)

The vulnerability involves the DRM client registration and restore process in the Linux kernel. When drm_client_register() adds a DRM client before invoking the initial hotplug callback, a failure in the hotplug callback leaves the client registered despite incomplete initialization. Specifically, for the framebuffer device (fbdev) client, failure during drm_fb_helper_initial_config() causes partial initialization and cleanup that sets fb_helper->info to NULL. However, the client remains registered. Later, when userspace closes the DRM file descriptor, drm_release() calls the restore callbacks unconditionally, including drm_fbdev_client_restore(), which attempts to restore the fbdev state even if it is partially initialized. This leads to accessing uninitialized state and a NULL pointer dereference. The fix involves checking whether the framebuffer device was fully initialized before attempting restore, skipping restore if not.

The vulnerability causes a kernel NULL pointer dereference, which can lead to a kernel crash (panic) when closing a DRM file descriptor associated with a partially initialized framebuffer device client. This results in denial of service by crashing the kernel. There is no indication of privilege escalation or arbitrary code execution from the provided data.

A fix has been implemented in the Linux kernel to check the framebuffer device initialization state before attempting to restore it, thereby preventing the NULL pointer dereference. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.