HIGH Introduced in 4.5
omapfb DisplayLock Race
CVE-2026-89599
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.6MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized. Initialize the mutex before registering the display so the published callbacks always see a valid lock.
02KernelScan AI Analysis
Risk summary
A race condition exists in the OMAP framebuffer display panel driver where the display is registered before its protecting mutex is initialized. A local user on a system with OMAP DSI display hardware could trigger a callback that uses the uninitialized lock, leading to undefined behavior ranging from a kernel crash to potential memory corruption. Exploitation requires specific OMAP SoC hardware and a narrow timing window during device probe.
Vulnerability analysis
The OMAP DSI display panel driver registers the display with the display subsystem before initializing the mutex that guards its private data structure. Once the display is published, any kernel consumer that calls into a panel callback can attempt to acquire this lock while it is still uninitialized, causing undefined behavior. The fix moves the mutex initialization ahead of the registration call so that every callback that runs after the display becomes visible always finds a valid lock. This issue is only reachable on systems with OMAP SoC hardware using the DSI panel driver, and exploitation requires a local actor to trigger display operations within the short window between registration and lock initialization during device probe.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.5 | 5.10.270 | ef20d4e17d7f |
| 5.15 | 4.5 | 5.15.221 | e7023d18c4eb |
| 6.1 | 4.5 | 6.1.188 | f33a96e49284 |
| 6.12 | 4.5 | 6.12.109 | 2c3f8c9c995d |
| 6.18 | 4.5 | 6.18.50 | 76818e81cfca |
| 6.6 | 4.5 | 6.6.157 | 302d19fbc7dc |
| 7.2 | 4.5 | 7.2.4 | 09db79078f25 |
| mainline | 4.5 | 7.3 | f8e43fe0f22b |
| cip/5.10 | 4.5 | 5.10.271-cip78 | ef20d4e17d7f |
| cip/6.1 | 4.5 | 6.1.189-cip61 | f33a96e49284 |
| cip/6.1-rt | 4.5 | 6.1.189-cip61-rt32 | f33a96e49284 |
| cip/6.12 | 4.5 | 6.12.111-cip32 | 2c3f8c9c995d |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |