CVE-2026-89599 - Vulnerability Details

- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

dsicm_probe() registers the display before initializing ddata->lock.
Once omapdss_register_display() publishes the display, another consumer
can reach a dsicm callback that takes this mutex while it is still
uninitialized.

Initialize the mutex before registering the display so the published
callbacks always see a valid lock.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The defect occurs when the omapfb panel DSI CM driver registers the display before initializing the associated mutex. If another component registers a callback that acquires the mutex while it is still uninitialized, the mutex pointer is used in an invalid state and can trigger a kernel crash. This results in a denial of service attack that can be executed by a user or change the display functionality.

Affected Systems

The vulnerability affects the Linux kernel, specifically the fbdev omapfb panel DSI CM driver. All kernel releases containing this driver component without the patch are vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is 0.00168, indicating a very low but nonzero probability of exploitation. The issue is not listed in CISA KEV, so no known active exploitation has been reported. Based on the description, the likely attack vector involves a local or privileged attacker interacting with the faulty omapfb driver, leveraging the race between display registration and mutex initialization to trigger a kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 2c3f8c9c995db185284b079f39177e85b2258176
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 76818e81cfcae33b09b739de09162c7d8d89bf0b
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 09db79078f25c048cfb5d7849795c70415ab8574
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< f8e43fe0f22b7137ce456e6fe3581d3098174f74

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,2c3f8c9c995db185284b079f39177e85b2258176)`	affected	code_commit	—
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,76818e81cfcae33b09b739de09162c7d8d89bf0b)`	affected	code_commit	—
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,09db79078f25c048cfb5d7849795c70415ab8574)`	affected	code_commit	—
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,f8e43fe0f22b7137ce456e6fe3581d3098174f74)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.5`	affected	generic	—
`[0,4.5)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch initializing the mutex before registering the display.
If a distribution update is not yet available, manually apply the patch to the omapfb source and rebuild the kernel with the corrected driver.
Until the patched kernel is available, disable the omapfb driver (e.g., unload the module or blacklist it) to prevent the callback race while the driver is in use.

Generated by OpenCVE AI on September 13, 2026 at 04:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574
https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176
https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b
https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74
https://nvd.nist.gov/vuln/detail/CVE-2026-89599
https://www.cve.org/CVERecord?id=CVE-2026-89599

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89599 https://www.cve.org/CVERecord?id=CVE-2026-89599
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized. Initialize the mutex before registering the display so the published callbacks always see a valid lock.
Title		fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574 https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176 https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:02.112Z

Updated: 2026-09-13T06:31:30.558Z

Reserved: 2026-09-11T19:38:34.731Z

Link: CVE-2026-89599

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:44.733

Modified: 2026-09-13T07:17:25.270

Link: CVE-2026-89599

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:02Z

Links: CVE-2026-89599 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T04:45:18Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object