CVE-2026-23049

A vulnerability in the Linux kernel's DRM subsystem (drm/panel-simple) affects the DataImage SCF0700C48GGU18 panel. The connector type for this panel was not set in the panel descriptor. The function devm_drm_panel_bridge_add() requires a valid connector type to be defined; if it is missing, a WARN_ON check triggers a kernel warning and backtrace, and the panel is not added to the display pipeline [1] [2] [3]. Root cause is an incomplete structure initialization in the panel driver.

Exploitation

This bug is triggered during normal system boot or module loading when the kernel attempts to register the panel. No special privileges or network access are required; it manifests automatically on systems using the affected panel with a kernel version containing the flawed commit. The warning is printed to the kernel log, and the display is non-functional.

Impact

An attacker who can cause the system to boot or reload the DRM driver can trigger the warning, but the primary impact is denial of service for the display output. The panel will not operate, leaving the system headless or with a blank screen. There is no information disclosure or privilege escalation.

Mitigation

The fix is contained in commits applied to the Linux kernel stable trees [1] [2] [3]. The solution adds the missing connector type (DRM_MODE_CONNECTOR_DPI) to the panel's structure. Users should update their kernel to a version containing the fix. No workaround exists short of patching or using a different panel.