---
id: CVE-2026-99007
title: 'drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN

  __drm_fb_helper_initial_config_and_unlock() calls
  drm_client_modeset_probe() first, which alre…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 <
    4a2006c675758f0c765b36fec6b49d17e89159cf
  - >-
    Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 <
    3b303696f61461b3569019d7fcac6a646652b2b4
  - >-
    Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 <
    4e7b508c7c60dec7a86b7eb2a1b7e6d174afa457
  - >-
    Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 <
    d510ed273854177f0a3ed330145858b2fe667f81
  - >-
    Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 <
    755c94d178b7e972bb766199d34e4ba4f63a89eb
  - Linux 4.14
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:20:32.381Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99007'
references:
  - url: 'https://git.kernel.org/stable/c/4a2006c675758f0c765b36fec6b49d17e89159cf'
  - url: 'https://git.kernel.org/stable/c/3b303696f61461b3569019d7fcac6a646652b2b4'
  - url: 'https://git.kernel.org/stable/c/4e7b508c7c60dec7a86b7eb2a1b7e6d174afa457'
  - url: 'https://git.kernel.org/stable/c/d510ed273854177f0a3ed330145858b2fe667f81'
  - url: 'https://git.kernel.org/stable/c/755c94d178b7e972bb766199d34e4ba4f63a89eb'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.540Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN

__drm_fb_helper_initial_config_and_unlock() calls
drm_client_modeset_probe() first, which already fills in each
mode_set->mode/num_connectors for every connected output, and only
afterwards calls drm_fb_helper_single_fb_probe() to create
fb_helper->fb and wire it into those mode_sets via
drm_setup_crtcs_fb().

If drm_fb_helper_single_fb_probe() fails with anything other than
-EAGAIN (e.g. dev->driver->fbdev_probe() itself fails), the function
bails out before drm_setup_crtcs_fb() runs and before setting
fb_helper->deferred_setup. The client is left with mode_sets that
have a mode and connectors but mode_set->fb == NULL, and nothing
marks this fb_helper as needing a retry.

__drm_fb_helper_restore_fbdev_mode_unlocked() only skips committing
when fb_helper->deferred_setup is set, so a later .restore() call
(drm_lastclose() on process exit, in this report) commits the stale
mode_set through drm_client_modeset_commit() ->
drm_client_modeset_commit_atomic() -> __drm_atomic_helper_set_config(),
which hits WARN_ON(!set->fb).

Mark fb_helper->deferred_setup on any drm_fb_helper_single_fb_probe()
failure, not just -EAGAIN, so restore keeps skipping the commit until
a later hotplug event successfully re-probes and re-populates
mode_set->fb. The real error code is still returned to the caller
unchanged.

## Affected

- `Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 < 4a2006c675758f0c765b36fec6b49d17e89159cf`
- `Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 < 3b303696f61461b3569019d7fcac6a646652b2b4`
- `Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 < 4e7b508c7c60dec7a86b7eb2a1b7e6d174afa457`
- `Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 < d510ed273854177f0a3ed330145858b2fe667f81`
- `Linux >= ca91a2758fcef6635626993557dd51cfbb6dd134 < 755c94d178b7e972bb766199d34e4ba4f63a89eb`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.