CVE-2026-89585 - Vulnerability Details

- auxdisplay: charlcd: cancel backlight work on registration failure

Description

In the Linux kernel, the following vulnerability has been resolved:

auxdisplay: charlcd: cancel backlight work on registration failure

With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before
charlcd_register() calls misc_register(). If registration fails, the
caller frees the charlcd object while delayed work still contains its
address.

Add charlcd_deinit() to cancel the delayed work and turn the backlight
off. Use it for both registration rollback and normal unregistration.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the charlcd driver with CONFIG_CHARLCD_BL_FLASH schedules a delayed backlight work item before the driver’s misc device is registered. If registration fails, the driver frees its internal object while the delayed work still references it, creating a use‑after‑free condition that can lead to arbitrary memory corruption and system crashes. The weakness is a classic improper release of resource flaw, CWE‑825.

Affected Systems

All Linux kernel builds that compile the charlcd driver with the CONFIG_CHARLCD_BL_FLASH option enabled are affected, including any distribution kernel that has not yet integrated the fix that cancels the delayed work during deinitialization. The vulnerability resides in the core Linux kernel driver code, not in a single vendor’s custom distribution.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, but the EPSS score is less than 1% and it is not listed in the CISA KEV catalog, suggesting a low likelihood of current exploitation. Based on the description, it is inferred that the attack vector is limited to local or privileged accounts that can trigger a registration failure; there is no exposed user‑space interface to induce the failure. Consequently, the overall risk remains moderate to low for typical production systems, but any system running an unpatched kernel with this configuration should be upgraded or patched promptly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< 22586432c1aba89d9bd33f3173408dac830f220b
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< 6eaed64a32e550daf0dc9549742b3ab9e41d984f
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< fe7ba73dde94c5f413b1588cd444b49105015dda
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< 84858671842ae5857b9ed1202b62f9045373dcd1
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755
`39f8ea46724efbed3ca021863a22337c31be264c`	affected	< e3e3bf40916c1e810df03958cfa7ba6883cdce79

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[39f8ea46724efbed3ca021863a22337c31be264c,fe7ba73dde94c5f413b1588cd444b49105015dda)`	affected	code_commit	—
`[39f8ea46724efbed3ca021863a22337c31be264c,84858671842ae5857b9ed1202b62f9045373dcd1)`	affected	code_commit	—
`[39f8ea46724efbed3ca021863a22337c31be264c,ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755)`	affected	code_commit	—
`[39f8ea46724efbed3ca021863a22337c31be264c,e3e3bf40916c1e810df03958cfa7ba6883cdce79)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that implements charlcd_deinit to cancel delayed work and turn off the backlight during registration rollback and normal unregistration.
Disable the CONFIG_CHARLCD_BL_FLASH compile option so that backlight work is scheduled only after successful registration.
If the charlcd driver is unused, blacklist or remove the module to eliminate the vulnerable code path.

Generated by OpenCVE AI on September 15, 2026 at 21:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/22586432c1aba89d9bd33f3173408dac830f220b
https://git.kernel.org/stable/c/6eaed64a32e550daf0dc9549742b3ab9e41d984f
https://git.kernel.org/stable/c/84858671842ae5857b9ed1202b62f9045373dcd1
https://git.kernel.org/stable/c/cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04
https://git.kernel.org/stable/c/e3e3bf40916c1e810df03958cfa7ba6883cdce79
https://git.kernel.org/stable/c/fe7ba73dde94c5f413b1588cd444b49105015dda
https://git.kernel.org/stable/c/ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755
https://nvd.nist.gov/vuln/detail/CVE-2026-89585
https://www.cve.org/CVERecord?id=CVE-2026-89585

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/22586432c1aba89d9bd33f3173408dac830f220b https://git.kernel.org/stable/c/6eaed64a32e550daf0dc9549742b3ab9e41d984f https://git.kernel.org/stable/c/cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89585 https://www.cve.org/CVERecord?id=CVE-2026-89585
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address. Add charlcd_deinit() to cancel the delayed work and turn the backlight off. Use it for both registration rollback and normal unregistration.
Title		auxdisplay: charlcd: cancel backlight work on registration failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/84858671842ae5857b9ed1202b62f9045373dcd1 https://git.kernel.org/stable/c/e3e3bf40916c1e810df03958cfa7ba6883cdce79 https://git.kernel.org/stable/c/fe7ba73dde94c5f413b1588cd444b49105015dda https://git.kernel.org/stable/c/ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:50.592Z

Updated: 2026-09-14T12:01:12.853Z

Reserved: 2026-09-11T19:38:34.729Z

Link: CVE-2026-89585

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:42.910

Modified: 2026-09-14T13:19:12.737

Link: CVE-2026-89585

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:50Z

Links: CVE-2026-89585 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:45:17Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object