CVE-2026-89597

The Linux kernel's uvesafb framebuffer driver registers its v86d connector callback early in uvesafb_init(), but if the subsequent platform_driver_register() call fails, the function returns without unregistering that callback. Because a failed module init causes the module to be unloaded, this leaves a dangling function pointer in the kernel's connector subsystem that can be dereferenced later, a classic use-after-free-style cleanup flaw. Triggering it requires local access with the ability to influence module loading and to induce the platform-driver registration failure, after which the stale callback could be reached through connector message traffic. The issue was found by static analysis rather than by observed exploitation, and CVSS 3.1 rates it 7.8 (high, local vector) with potential impact on kernel confidentiality, integrity, and availability, though practical exploitability is expected to be limited. No public proof of concept and no in-the-wild exploitation are known.

What to do: Apply kernel updates from your distro once the one-line cleanup fix (unregistering the connector callback on the platform_driver_register failure path) is backported. Verify exposure with 'lsmod | grep uvesafb' and check whether the v86d package is installed; on systems not using this legacy framebuffer, blacklist the uvesafb module to eliminate the code path entirely.