CVE-2026-89599 - Vulnerability Details

- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

dsicm_probe() registers the display before initializing ddata->lock.
Once omapdss_register_display() publishes the display, another consumer
can reach a dsicm callback that takes this mutex while it is still
uninitialized.

Initialize the mutex before registering the display so the published
callbacks always see a valid lock.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel’s fbdev omapfb panel DSI CM driver allows a driver to register a display before initializing the mutex that protects its callback data. When another component invokes a callback during registration, it may acquire this uninitialized lock, leading to undefined behavior and a kernel crash. The flaw is identified as CWE-908, a race condition.

Affected Systems

The vulnerability affects all Linux kernel builds that include the unpatched omapfb panel DSI CM driver. The publicly available information does not list specific kernel versions, so any kernel containing the unmodified driver code prior to the patch is considered vulnerable.

Risk and Exploitability

The high‑severity CVSS score of 8.4 indicates significant impact. The EPSS score of less than 1% reflects a low probability of exploitation, and the flaw is not present in the CISA KEV catalog. Based on the description, the likely attack vector is a local or privileged user capable of loading or interacting with the omapfb driver, potentially causing a denial of service through kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< ef20d4e17d7fb0d83144caa9667e6f3198288993
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< e7023d18c4eb292f886b31a3576402cb0e357df7
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< f33a96e49284589257e90ddc4394ec0c6bf11ec4
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 302d19fbc7dc7e9f498930c66d65ff711ba5ba9f
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 2c3f8c9c995db185284b079f39177e85b2258176
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 76818e81cfcae33b09b739de09162c7d8d89bf0b
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< 09db79078f25c048cfb5d7849795c70415ab8574
`f76ee892a99e68b55402b8d4b8aeffcae2aff34d`	affected	< f8e43fe0f22b7137ce456e6fe3581d3098174f74

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,2c3f8c9c995db185284b079f39177e85b2258176)`	affected	code_commit	—
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,76818e81cfcae33b09b739de09162c7d8d89bf0b)`	affected	code_commit	—
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,09db79078f25c048cfb5d7849795c70415ab8574)`	affected	code_commit	—
`[f76ee892a99e68b55402b8d4b8aeffcae2aff34d,f8e43fe0f22b7137ce456e6fe3581d3098174f74)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.5`	affected	generic	—
`[0,4.5)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that incorporates the upstream patch for the omapfb driver.
If a vendor update is unavailable, apply the commit that initializes the lock before registration to the driver source and rebuild the kernel.
As a temporary defense, disable or blacklist the omapfb module to prevent exposure of the uninitialized lock.

Generated by OpenCVE AI on September 15, 2026 at 21:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574
https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176
https://git.kernel.org/stable/c/302d19fbc7dc7e9f498930c66d65ff711ba5ba9f
https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b
https://git.kernel.org/stable/c/e7023d18c4eb292f886b31a3576402cb0e357df7
https://git.kernel.org/stable/c/ef20d4e17d7fb0d83144caa9667e6f3198288993
https://git.kernel.org/stable/c/f33a96e49284589257e90ddc4394ec0c6bf11ec4
https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74
https://nvd.nist.gov/vuln/detail/CVE-2026-89599
https://www.cve.org/CVERecord?id=CVE-2026-89599

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/302d19fbc7dc7e9f498930c66d65ff711ba5ba9f https://git.kernel.org/stable/c/e7023d18c4eb292f886b31a3576402cb0e357df7 https://git.kernel.org/stable/c/ef20d4e17d7fb0d83144caa9667e6f3198288993 https://git.kernel.org/stable/c/f33a96e49284589257e90ddc4394ec0c6bf11ec4

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89599 https://www.cve.org/CVERecord?id=CVE-2026-89599
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized. Initialize the mutex before registering the display so the published callbacks always see a valid lock.
Title		fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574 https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176 https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:02.112Z

Updated: 2026-09-14T12:01:22.440Z

Reserved: 2026-09-11T19:38:34.731Z

Link: CVE-2026-89599

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:44.733

Modified: 2026-09-14T13:19:14.150

Link: CVE-2026-89599

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:02Z

Links: CVE-2026-89599 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:30:16Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object