SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-89599

HIGH · CVSS 8.4 EPSS 0.14%

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's fbdev subsystem, specifically within the omapfb driver, where a mutex is not initialized before the display is registered. This oversight can lead to race conditions, potentially allowing unauthorized access or manipulation of the display callbacks by other consumers. Organizations using Linux systems with this kernel component should prioritize addressing this issue to mitigate risks associated with improper synchronization and potential system instability.

CVE
CVE-2026-89599
Severity
HIGH
CVSS
8.4
EPSS
0.14%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized. Initialize the mutex before registering the display so the published callbacks always see a valid lock.