CVE-2026-89599

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

HIGH
8.4
CVSS Score
Published: September 11, 2026 at 07:45 PM UTC
Updated: October 19, 2026 at 09:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.4
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_display() publishes the display, another consumer can reach a dsicm callback that takes this mutex while it is still uninitialized. Initialize the mutex before registering the display so the published callbacks always see a valid lock.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.5f76ee892a99e68b55402b8d4b8aeffcae2aff34d
Vendor states this is fixed in 09db79078f25c048cfb5d7849795c70415ab8574 (fixed)
Vendor states this is fixed in 2c3f8c9c995db185284b079f39177e85b2258176 (fixed)
Vendor states this is fixed in 302d19fbc7dc7e9f498930c66d65ff711ba5ba9f (fixed)
Vendor states this is fixed in 76818e81cfcae33b09b739de09162c7d8d89bf0b (fixed)
Vendor states this is fixed in e7023d18c4eb292f886b31a3576402cb0e357df7 (fixed)
Vendor states this is fixed in ef20d4e17d7fb0d83144caa9667e6f3198288993 (fixed)
Vendor states this is fixed in f33a96e49284589257e90ddc4394ec0c6bf11ec4 (fixed)
Vendor states this is fixed in f8e43fe0f22b7137ce456e6fe3581d3098174f74 (fixed)
Vendor states this is fixed in 4.5 (unaffected)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.109 (unaffected)
Vendor states this is fixed in 6.18.50 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.4 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

8.4HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card