HIGH Introduced in 2.6.24
uvesafb ConnectorCallback Leak
CVE-2026-89597
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered. The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
02KernelScan AI Analysis
Risk summary
A missing cleanup in the uvesafb driver's initialization error path leaves a connector callback registered after the module is unloaded, creating a dangling function pointer. If a connector message arrives after the failed module load, the kernel panics by executing freed code. This requires root-level module loading privileges and a specific error condition during initialization, making exploitation difficult but the impact a kernel-level denial of service.
Vulnerability analysis
The uvesafb framebuffer driver registers a connector callback for communication with a userspace daemon during module initialization, but if a subsequent platform driver registration step fails, the function returns without unregistering that callback. When the module is then unloaded by the kernel, the connector subsystem retains a pointer to the now-freed callback code. Any connector message arriving afterward causes the kernel to jump to unmapped memory, resulting in a panic. The fix adds the missing callback unregistration in the early error path, matching the cleanup already present in the later failure path. This issue is reachable only on systems where the uvesafb module is loaded, which requires root or boot-time configuration, and the dangling callback is triggered by a local connector message after a failed module initialization.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.24 | 5.10.270 | b149f77d0408 |
| 5.15 | 2.6.24 | 5.15.221 | 0352fdac3cbf |
| 6.1 | 2.6.24 | 6.1.188 | 17518e7123f7 |
| 6.12 | 2.6.24 | 6.12.109 | 9f8a822b44c4 |
| 6.18 | 2.6.24 | 6.18.50 | 466a8af0dee2 |
| 6.6 | 2.6.24 | 6.6.157 | 9eb7b3cbe99c |
| 7.2 | 2.6.24 | 7.2.4 | 9e768ae51426 |
| mainline | 2.6.24 | 7.3 | de8db23aa7c3 |
| cip/5.10 | 2.6.24 | 5.10.271-cip78 | b149f77d0408 |
| cip/6.1 | 2.6.24 | 6.1.189-cip61 | 17518e7123f7 |
| cip/6.1-rt | 2.6.24 | 6.1.189-cip61-rt32 | 17518e7123f7 |
| cip/6.12 | 2.6.24 | 6.12.111-cip32 | 9f8a822b44c4 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |