CVE-2026-89599

The Linux kernel's omapfb DSI-CM panel driver (panel-dsi-cm) registers its display via omapdss_register_display() before initializing the ddata->lock mutex inside dsicm_probe(), publishing callbacks that can grab a lock that is not yet valid. Once the display is published, another in-kernel consumer racing during probe can invoke one of these callbacks and trigger use of the uninitialized mutex, causing undefined behavior such as memory corruption or a crash. The flaw is local in nature (AV:L per the CVSS 3.1 vector, scored 8.4 with high C/I/A impact), and an attacker with local access to a vulnerable system could at minimum disrupt the display subsystem and potentially corrupt kernel state. Only systems actually running this legacy driver are affected: embedded boards built on Texas Instruments OMAP SoCs with DSI command-mode panels, such as N900/BeagleBoard/PandaBoard-class hardware — ordinary servers, desktops, and modern phones on other SoCs are unaffected. No public proof of concept exists and no exploitation has been observed (the CVE is not in the CISA KEV).

What to do: Update to a kernel release or vendor backport that includes the fix (the mutex is now initialized before omapdss_register_display()); no fixed version number was specified in the advisory. Check whether the driver is even in play — verify CONFIG_FB_OMAP* options in the kernel config and whether omapfb/panel-dsi-cm modules are loaded. If the hardware or driver is unused, disable or blacklist the panel-dsi-cm driver, and restrict local untrusted access to any affected OMAP-based embedded devices.