KernelScan.io

HIGH Introduced in 2.6.24

uvesafb ConnectorCallback Leak

CVE-2026-89597

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI6.4MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered. The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

02

Engine v0.6.0

Risk summary

A missing cleanup in the uvesafb driver's initialization error path leaves a connector callback registered after the module is unloaded, creating a dangling function pointer. If a connector message arrives after the failed module load, the kernel panics by executing freed code. This requires root-level module loading privileges and a specific error condition during initialization, making exploitation difficult but the impact a kernel-level denial of service.

Affecteddrivers/video/fbdev/uvesafb.c (fbdev uvesafb driver)

Vulnerability analysis

The uvesafb framebuffer driver registers a connector callback for communication with a userspace daemon during module initialization, but if a subsequent platform driver registration step fails, the function returns without unregistering that callback. When the module is then unloaded by the kernel, the connector subsystem retains a pointer to the now-freed callback code. Any connector message arriving afterward causes the kernel to jump to unmapped memory, resulting in a panic. The fix adds the missing callback unregistration in the early error path, matching the cleanup already present in the later failure path. This issue is reachable only on systems where the uvesafb module is loaded, which requires root or boot-time configuration, and the dangling callback is triggered by a local connector message after a failed module initialization.

03

BranchIntroducedFixed inPatch commit
5.102.6.245.10.270b149f77d0408
5.152.6.245.15.2210352fdac3cbf
6.12.6.246.1.18817518e7123f7
6.122.6.246.12.1099f8a822b44c4
6.182.6.246.18.50466a8af0dee2
6.62.6.246.6.1579eb7b3cbe99c
7.22.6.247.2.49e768ae51426
mainline2.6.247.3de8db23aa7c3
cip/5.102.6.245.10.271-cip78b149f77d0408
cip/6.12.6.246.1.189-cip6117518e7123f7
cip/6.1-rt2.6.246.1.189-cip61-rt3217518e7123f7
cip/6.122.6.246.12.111-cip329f8a822b44c4

04

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP treeState
cip/6.12Fixed in 6.12.111-cip32
cip/6.1Fixed in 6.1.189-cip61
cip/6.1-rtFixed in 6.1.189-cip61-rt32
cip/5.10Fixed in 5.10.271-cip78
cip/5.10-rtAffected — no CIP fix yet (latest 5.10.268-cip77-rt34)
cip/4.19Affected — no CIP fix yet (latest 4.19.325-cip136)
cip/4.19-rtAffected — no CIP fix yet (latest 4.19.325-cip136-rt50)
cip/4.4Affected — no CIP fix yet (latest 4.4.302-cip115)
cip/4.4-rtAffected — no CIP fix yet (latest 4.4.302-cip115-rt63)