In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN… (CVE-2026-99007)

The vulnerability in the Linux kernel's drm/fb-helper subsystem arises from drm_fb_helper_single_fb_probe() failing with error codes other than -EAGAIN and not marking fb_helper->deferred_setup. This leads to mode_sets having modes and connectors but a NULL framebuffer pointer, causing __drm_fb_helper_restore_fbdev_mode_unlocked() to commit stale configurations later, which triggers WARN_ON(!set->fb). The patch changes the logic to mark deferred_setup on any failure of drm_fb_helper_single_fb_probe(), ensuring that stale commits are skipped until a hotplug event re-probes and repopulates mode_set->fb. The error code returned to the caller remains unchanged.

The impact is that stale framebuffer configurations could be committed, which triggers kernel warnings (WARN_ON). This may lead to instability or unexpected behavior in the display subsystem but does not indicate direct code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to mark deferred setup on any drm_fb_helper_single_fb_probe() failure, preventing stale commits. Users should update to the fixed kernel version once available. No additional mitigation is indicated by the vendor advisory.