CVE-2026-98973

Not scored yetLast modified Oct 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: Fix unlocked list_del in drm_bridge_add()

When re-adding a bridge that was previously removed, drm_bridge_add() drops it from bridge_lingering_list without holding bridge_lock.

Both bridge_list and bridge_lingering_list are protected by bridge_lock, as they are concurrently modified by drm_bridge_remove() and __drm_bridge_free(), and walked by the debugfs 'bridges' file. Running the list_empty() test and the list_del_init() outside of the lock may therefore corrupt either list.

Perform both under bridge_lock.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-989747.8In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posteCVE-2026-989757.8In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exCVE-2026-989767.8In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved benCVE-2026-98977In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts areCVE-2026-989788.4In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. TheyCVE-2026-98979In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace ICVE-2026-98988.3Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compCVE-2026-989808.8In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentCVE-2026-989818.8In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(),CVE-2026-989827.8In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloCVE-2026-98983In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken CVE-2026-98984In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(
CVE-2026-98973: Unscored | Vulnix