CVE-2026-89599

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

State: Published
Severity: 8.4 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized.

Initialize the mutex before registering the display so the published callbacks always see a valid lock.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before ef20d4e17d7fb0d83144caa9667e6f3198288993Affected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before e7023d18c4eb292f886b31a3576402cb0e357df7Affected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before f33a96e49284589257e90ddc4394ec0c6bf11ec4Affected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 302d19fbc7dc7e9f498930c66d65ff711ba5ba9fAffected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 2c3f8c9c995db185284b079f39177e85b2258176Affected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 76818e81cfcae33b09b739de09162c7d8d89bf0bAffected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 09db79078f25c048cfb5d7849795c70415ab8574Affected f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before f8e43fe0f22b7137ce456e6fe3581d3098174f74Affected
LinuxLinux	4.5Affected before 4.5Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before ef20d4e17d7fb0d83144caa9667e6f3198288993Affected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before e7023d18c4eb292f886b31a3576402cb0e357df7Affected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before f33a96e49284589257e90ddc4394ec0c6bf11ec4Affected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 302d19fbc7dc7e9f498930c66d65ff711ba5ba9fAffected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 2c3f8c9c995db185284b079f39177e85b2258176Affected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 76818e81cfcae33b09b739de09162c7d8d89bf0bAffected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before 09db79078f25c048cfb5d7849795c70415ab8574Affected
f76ee892a99e68b55402b8d4b8aeffcae2aff34d to before f8e43fe0f22b7137ce456e6fe3581d3098174f74Affected

LinuxLinux

4.5Affected
before 4.5Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.