{"id":"CVE-2026-89599","state":"PUBLISHED","title":"fbdev: omapfb: panel-dsi-cm: initialize lock before registering display","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: panel-dsi-cm: initialize lock before registering display\n\ndsicm_probe() registers the display before initializing ddata->lock.\nOnce omapdss_register_display() publishes the display, another consumer\ncan reach a dsicm callback that takes this mutex while it is still\nuninitialized.\n\nInitialize the mutex before registering the display so the published\ncallbacks always see a valid lock.","publishedAt":"2026-09-11T19:45:02.112Z","updatedAt":"2026-10-19T08:49:31.606Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"ef20d4e17d7fb0d83144caa9667e6f3198288993","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"e7023d18c4eb292f886b31a3576402cb0e357df7","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"f33a96e49284589257e90ddc4394ec0c6bf11ec4","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"302d19fbc7dc7e9f498930c66d65ff711ba5ba9f","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"2c3f8c9c995db185284b079f39177e85b2258176","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"76818e81cfcae33b09b739de09162c7d8d89bf0b","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"09db79078f25c048cfb5d7849795c70415ab8574","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"f8e43fe0f22b7137ce456e6fe3581d3098174f74","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.5","versionType":"semver"},{"version":"5.10.270","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c"]}],"references":["https://git.kernel.org/stable/c/ef20d4e17d7fb0d83144caa9667e6f3198288993","https://git.kernel.org/stable/c/e7023d18c4eb292f886b31a3576402cb0e357df7","https://git.kernel.org/stable/c/f33a96e49284589257e90ddc4394ec0c6bf11ec4","https://git.kernel.org/stable/c/302d19fbc7dc7e9f498930c66d65ff711ba5ba9f","https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176","https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b","https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574","https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89599.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89599","state":"PUBLISHED","datePublished":"2026-09-11T19:45:02.112Z","dateUpdated":"2026-10-19T08:49:31.606Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.731Z"},"containers":{"cna":{"title":"fbdev: omapfb: panel-dsi-cm: initialize lock before registering display","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: panel-dsi-cm: initialize lock before registering display\n\ndsicm_probe() registers the display before initializing ddata->lock.\nOnce omapdss_register_display() publishes the display, another consumer\ncan reach a dsicm callback that takes this mutex while it is still\nuninitialized.\n\nInitialize the mutex before registering the display so the published\ncallbacks always see a valid lock."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"ef20d4e17d7fb0d83144caa9667e6f3198288993","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"e7023d18c4eb292f886b31a3576402cb0e357df7","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"f33a96e49284589257e90ddc4394ec0c6bf11ec4","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"302d19fbc7dc7e9f498930c66d65ff711ba5ba9f","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"2c3f8c9c995db185284b079f39177e85b2258176","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"76818e81cfcae33b09b739de09162c7d8d89bf0b","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"09db79078f25c048cfb5d7849795c70415ab8574","versionType":"git"},{"version":"f76ee892a99e68b55402b8d4b8aeffcae2aff34d","status":"affected","lessThan":"f8e43fe0f22b7137ce456e6fe3581d3098174f74","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.5","versionType":"semver"},{"version":"5.10.270","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.109","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ef20d4e17d7fb0d83144caa9667e6f3198288993"},{"url":"https://git.kernel.org/stable/c/e7023d18c4eb292f886b31a3576402cb0e357df7"},{"url":"https://git.kernel.org/stable/c/f33a96e49284589257e90ddc4394ec0c6bf11ec4"},{"url":"https://git.kernel.org/stable/c/302d19fbc7dc7e9f498930c66d65ff711ba5ba9f"},{"url":"https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176"},{"url":"https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b"},{"url":"https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574"},{"url":"https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in the OMAP DSI command-mode panel driver: dsicm_probe() publishes dsicm_ops via omapdss_register_display(), and those callbacks are reached from local omapfb probe, FBIOBLANK, and omapfb ioctls on /dev/fb*. There is no network, Bluetooth/WiFi, or USB protocol path into this code.\nAC:L - On preemptible kernels dsicm_probe() can be preempted after omapdss_register_display() adds the panel to panel_list and before mutex_init(&ddata->lock). Concurrent omapfb_probe then calls dsicm_enable/enable_te/update on that published device, so the race is driven by the in-kernel consumer rather than an uninfluenced hardware lottery.\nPR:N - dsicm_probe() and the omapfb consumer (omapfb_init_display → driver->enable/update) run from platform/deferred probe during boot on boards with an omapdss,panel-dsi-cm node. That path has no capable() or credential check and needs no OS account.\nUI:N - Display registration and omapfb’s subsequent enable/update run automatically during device enumeration on affected TI OMAP systems; no victim must open /dev/fb*, write sysfs, or mount a filesystem.\nS:U - Uninitialized-mutex use and any follow-on lock or DSI-state corruption remain inside the host omapfb/omapdss driver. This is not a VM escape, IOMMU bypass, or other cross-authority impact.\nC:H - A consumer that wins the race mutex_lock()s kzalloc’d ddata->lock (NULL wait_list); probe can then mutex_init() a lock another thread still holds so two threads enter dsicm_enable/update. That lock-state corruption is kernel memory-unsafety that can be leveraged for disclosure, not a small bounded leak.\nI:H - mutex_init() of a mutex another thread still holds resets owner and wait_list while dsicm callbacks run unsynchronized against DSI bus and panel_drv_data state, giving write and control-flow primitives rather than a pure crash.\nA:H - CONFIG_DEBUG_MUTEXES treats lock-used-without-init as an oops, and a corrupted mutex wait_list or double-entry into DSI enable/disable causes a kernel oops, panic, or hang, fully denying availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:49:31.606Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}