{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89599","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.731Z","datePublished":"2026-09-11T19:45:02.112Z","dateUpdated":"2026-09-14T12:01:22.440Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-14T12:01:22.440Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: panel-dsi-cm: initialize lock before registering display\n\ndsicm_probe() registers the display before initializing ddata->lock.\nOnce omapdss_register_display() publishes the display, another consumer\ncan reach a dsicm callback that takes this mutex while it is still\nuninitialized.\n\nInitialize the mutex before registering the display so the published\ncallbacks always see a valid lock."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in the OMAP DSI command-mode panel driver: dsicm_probe() publishes dsicm_ops via omapdss_register_display(), and those callbacks are reached from local omapfb probe, FBIOBLANK, and omapfb ioctls on /dev/fb*. There is no network, Bluetooth/WiFi, or USB protocol path into this code.\nAC:L - On preemptible kernels dsicm_probe() can be preempted after omapdss_register_display() adds the panel to panel_list and before mutex_init(&ddata->lock). Concurrent omapfb_probe then calls dsicm_enable/enable_te/update on that published device, so the race is driven by the in-kernel consumer rather than an uninfluenced hardware lottery.\nPR:N - dsicm_probe() and the omapfb consumer (omapfb_init_display → driver->enable/update) run from platform/deferred probe during boot on boards with an omapdss,panel-dsi-cm node. That path has no capable() or credential check and needs no OS account.\nUI:N - Display registration and omapfb’s subsequent enable/update run automatically during device enumeration on affected TI OMAP systems; no victim must open /dev/fb*, write sysfs, or mount a filesystem.\nS:U - Uninitialized-mutex use and any follow-on lock or DSI-state corruption remain inside the host omapfb/omapdss driver. This is not a VM escape, IOMMU bypass, or other cross-authority impact.\nC:H - A consumer that wins the race mutex_lock()s kzalloc’d ddata->lock (NULL wait_list); probe can then mutex_init() a lock another thread still holds so two threads enter dsicm_enable/update. That lock-state corruption is kernel memory-unsafety that can be leveraged for disclosure, not a small bounded leak.\nI:H - mutex_init() of a mutex another thread still holds resets owner and wait_list while dsicm callbacks run unsynchronized against DSI bus and panel_drv_data state, giving write and control-flow primitives rather than a pure crash.\nA:H - CONFIG_DEBUG_MUTEXES treats lock-used-without-init as an oops, and a corrupted mutex wait_list or double-entry into DSI enable/disable causes a kernel oops, panic, or hang, fully denying availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c"],"versions":[{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"ef20d4e17d7fb0d83144caa9667e6f3198288993","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"e7023d18c4eb292f886b31a3576402cb0e357df7","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"f33a96e49284589257e90ddc4394ec0c6bf11ec4","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"302d19fbc7dc7e9f498930c66d65ff711ba5ba9f","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"2c3f8c9c995db185284b079f39177e85b2258176","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"76818e81cfcae33b09b739de09162c7d8d89bf0b","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"09db79078f25c048cfb5d7849795c70415ab8574","status":"affected","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","lessThan":"f8e43fe0f22b7137ce456e6fe3581d3098174f74","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c"],"versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","status":"unaffected","versionType":"semver"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ef20d4e17d7fb0d83144caa9667e6f3198288993"},{"url":"https://git.kernel.org/stable/c/e7023d18c4eb292f886b31a3576402cb0e357df7"},{"url":"https://git.kernel.org/stable/c/f33a96e49284589257e90ddc4394ec0c6bf11ec4"},{"url":"https://git.kernel.org/stable/c/302d19fbc7dc7e9f498930c66d65ff711ba5ba9f"},{"url":"https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176"},{"url":"https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b"},{"url":"https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574"},{"url":"https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74"}],"title":"fbdev: omapfb: panel-dsi-cm: initialize lock before registering display","x_generator":{"engine":"bippy-1.2.0"}}}}