CVE-2026-89585

A use-after-free exists in the Linux kernel's auxdisplay charlcd driver when built with CONFIG_CHARLCD_BL_FLASH. The init path schedules a delayed work item for backlight flashing before charlcd_register() attempts device registration, so if registration fails the caller frees the charlcd object while the delayed work structure still holds its address, and the work queue later dereferences freed memory. An attacker with local, low-privileged access who can trigger or race the registration-failure path could exploit this for kernel memory corruption, with CVSS 3.1 scoring of 7.8 (high, local vector, C:H/I:H/A:H) indicating potential privilege escalation to kernel-level code execution. Only systems running kernels with the charlcd driver and the backlight-flash option enabled — typically custom embedded or hobbyist builds using character LCD panels (HD44780-class) — are exposed, since mainstream distribution kernels generally do not enable this option. There is no public proof-of-concept, and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation is considered theoretical at this time.

What to do: Update to a kernel that includes the charlcd_deinit() fix, which cancels the delayed backlight work and powers off the backlight on both registration rollback and normal unregistration. Check whether your kernel config sets CONFIG_CHARLCD / CONFIG_CHARLCD_BL_FLASH — stock distro kernels typically do not, in which case the system is not affected. For custom embedded builds that do use charlcd, rebuild against a patched kernel or disable the backlight-flash option until an upgrade is possible.