CVE-2026-98523

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) subsystem. A local user can cause a Denial of Service (DoS) by closing a DRM device file descriptor associated with a partially initialized client. Because the kernel fails to properly unregister an incomplete framebuffer client after initialization errors, subsequent cleanup operations trigger a null-pointer dereference that crashes the system.

This vulnerability is rated as Moderate because successful exploitation requires local authenticated access and specific display initialization failures, limiting the blast radius to a denial of service without compromising data confidentiality or integrity. On standard Red Hat Enterprise Linux installations, Direct Rendering Manager devices are not typically accessible to unprivileged users or exposed on headless servers. Consequently, the flaw cannot be triggered remotely and requires specific error states during graphics device setup followed by the release of the associated file handle.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.