SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-89585

HIGH · CVSS 7.8 EPSS 0.16%

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's charlcd driver, specifically in the handling of backlight work during registration failures. If the registration of the charlcd object fails, it can lead to a use-after-free condition, potentially allowing for unexpected behavior or system instability. Linux system administrators and developers utilizing the charlcd driver should prioritize applying the fix to mitigate any risks associated with this issue.

CVE
CVE-2026-89585
Severity
HIGH
CVSS
7.8
EPSS
0.16%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address. Add charlcd_deinit() to cancel the delayed work and turn the backlight off. Use it for both registration rollback and normal unregistration.