In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN __drm_fb_helper_initial_config_and_unlock() calls drm_client_modeset_probe() first, which already fills in each mode_set->mode/num_connectors for every connected output, and only afterwards calls drm_fb_helper_single_fb_probe() to create fb_helper->fb and wire it into those mode_sets via drm_setup_crtcs_fb(). If drm_fb_helper_single_fb_probe() fails with anything other than -EAGAIN (e.g. dev->driver->fbdev_probe() itself fails), the function bails out before drm_setup_crtcs_fb() runs and before setting fb_helper->deferred_setup. The client is left with mode_sets that have a mode and connectors but mode_set->fb == NULL, and nothing marks this fb_helper as needing a retry. __drm_fb_helper_restore_fbdev_mode_unlocked() only skips committing when fb_helper->deferred_setup is set, so a later .restore() call (drm_lastclose() on process exit, in this report) commits the stale mode_set through drm_client_modeset_commit() -> drm_client_modeset_commit_atomic() -> __drm_atomic_helper_set_config(), which hits WARN_ON(!set->fb). Mark fb_helper->deferred_setup on any drm_fb_helper_single_fb_probe() failure, not just -EAGAIN, so restore keeps skipping the commit until a later hotplug event successfully re-probes and re-populates mode_set->fb. The real error code is still returned to the caller unchanged.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
    __drm_fb_helper_initial_config_and_unlock() calls drm_client_modeset_probe() first, which already fills in     each mode_set->mode/num_connectors for every connected output, and only afterwards calls     drm_fb_helper_single_fb_probe() to create fb_helper->fb and wire it into those mode_sets via     drm_setup_crtcs_fb(). If drm_fb_helper_single_fb_probe() fails with anything other than -EAGAIN (e.g.
    dev->driver->fbdev_probe() itself fails), the function bails out before drm_setup_crtcs_fb() runs and     before setting fb_helper->deferred_setup. The client is left with mode_sets that have a mode and     connectors but mode_set->fb == NULL, and nothing marks this fb_helper as needing a retry.
    __drm_fb_helper_restore_fbdev_mode_unlocked() only skips committing when fb_helper->deferred_setup is set,     so a later .restore() call (drm_lastclose() on process exit, in this report) commits the stale mode_set     through drm_client_modeset_commit() -> drm_client_modeset_commit_atomic() ->
    __drm_atomic_helper_set_config(), which hits WARN_ON(!set->fb). Mark fb_helper->deferred_setup on any     drm_fb_helper_single_fb_probe() failure, not just -EAGAIN, so restore keeps skipping the commit until a     later hotplug event successfully re-probes and re-populates mode_set->fb. The real error code is still     returned to the caller unchanged. (CVE-2026-99007)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
381201	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:22266-1)	Nessus	SuSE Local Security Checks	Local	high
381194	openSUSE 16: cluster-md-kmp-nvidia64kb / dlm-kmp-nvidia64kb / etc (openSUSE-SU-2026:22307-1)	Nessus	SuSE Local Security Checks	Local	high
379876	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-121)	Nessus	Amazon Linux Local Security Checks	Local	critical
379844	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-139)	Nessus	Amazon Linux Local Security Checks	Local	critical
379497	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24651-1)	Nessus	SuSE Local Security Checks	Local	high
379474	SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24662-1)	Nessus	SuSE Local Security Checks	Local	high
376285	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:5091-1)	Nessus	SuSE Local Security Checks	Local	critical
375086	Photon OS 5.0: Linux PHSA-2026-5.0-92-1044	Nessus	PhotonOS Local Security Checks	Local	critical
373466	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3335)	Nessus	Amazon Linux Local Security Checks	Local	medium
371517	Linux Distros Unpatched Vulnerability : CVE-2026-99007	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-99007

medium

Tenable Plugins

high

high

critical

critical

high

high

critical

critical

medium

medium