LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23049: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel

In the Linux kernel, the following vulnerability has been resolved: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set. This leads to a warning and a backtrace in the kernel log and panel does not work: " WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8 " The warning is triggered by a check for valid connector type in devm_drm_panel_bridge_add(). If there is no valid connector type set for a panel, the warning is printed and panel is not added. Fill in the missing connector type to fix the warning and make the panel operational once again.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2026-23049 is a Linux kernel display-panel bug. For systems using the DataImage SCF0700C48GGU18 panel, the kernel may log a warning/backtrace and fail to add the panel, making the display non-operational. The public record does not show data theft, privilege escalation, or active exploitation.

Executive priority

Treat as low business urgency unless affected products rely on this panel for critical operations. The main risk is device display failure or degraded appliance usability, not confirmed compromise. Address through routine kernel maintenance or product vendor updates.

Technical view

The Linux drm/panel-simple driver omitted a connector type for the DataImage SCF0700C48GGU18 panel. devm_drm_panel_bridge_add() requires a valid connector type, so the missing value triggers a kernel warning and prevents the panel bridge from being added. Stable kernel commits fill in the missing connector type.

Likely exposure

Exposure appears limited to Linux systems or embedded products using the DataImage SCF0700C48GGU18 panel with affected kernel code. General-purpose Linux servers, desktops, or cloud workloads are unlikely to be exposed unless this specific panel driver path is used.

Exploitation context

No CISA KEV listing is provided, and the supplied sources do not report active exploitation. The described impact is functional availability of a specific display panel, not a remote attack path. Evidence is insufficient to assess broader security impact.

Researcher notes

The CVE record lists severity as unknown and provides no CVSS or CWE. The source description is a kernel correctness fix for drm/panel-simple. Affected-version data in the bundle is limited and should be reconciled against the exact vendor kernel tree and backports.

Mitigation direction

  • Check vendor or distribution advisories for a kernel containing the referenced stable fixes.
  • Prioritize embedded or appliance products using the DataImage SCF0700C48GGU18 panel.
  • Update affected kernels through normal vendor-supported kernel update channels.
  • If updates are unavailable, request vendor guidance for this specific panel driver fix.

Validation and detection

  • Inventory products using the DataImage SCF0700C48GGU18 panel.
  • Check whether the running kernel includes one of the referenced stable commits.
  • Review kernel logs for the reported panel bridge warning or backtrace.
  • Confirm the display panel initializes and operates after remediation.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23049 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux97ceb1fb08b6a2f78aa44a7c229ca280964860c0, 97ceb1fb08b6a2f78aa44a7c229ca280964860c0, 97ceb1fb08b6a2f78aa44a7c229ca280964860c0, 97ceb1fb08b6a2f78aa44a7c229ca280964860c0, 97ceb1fb08b6a2f78aa44a7c229ca280964860c0, 97ceb1fb08b6a2f78aa44a7c229ca280964860c0, 97ceb1fb08b6a2f78aa44a7c229ca280964860c0unaffected
LinuxLinux4.19, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.