GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89585 (GCVE-0-2026-89585)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:01
VLAI
Title
auxdisplay: charlcd: cancel backlight work on registration failure
Summary
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address. Add charlcd_deinit() to cancel the delayed work and turn the backlight off. Use it for both registration rollback and normal unregistration.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04 (git)
Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < 22586432c1aba89d9bd33f3173408dac830f220b (git)
Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < 6eaed64a32e550daf0dc9549742b3ab9e41d984f (git)
Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < fe7ba73dde94c5f413b1588cd444b49105015dda (git)
Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < 84858671842ae5857b9ed1202b62f9045373dcd1 (git)
Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755 (git)
Affected: 39f8ea46724efbed3ca021863a22337c31be264c , < e3e3bf40916c1e810df03958cfa7ba6883cdce79 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/auxdisplay/charlcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            },
            {
              "lessThan": "22586432c1aba89d9bd33f3173408dac830f220b",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            },
            {
              "lessThan": "6eaed64a32e550daf0dc9549742b3ab9e41d984f",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            },
            {
              "lessThan": "fe7ba73dde94c5f413b1588cd444b49105015dda",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            },
            {
              "lessThan": "84858671842ae5857b9ed1202b62f9045373dcd1",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            },
            {
              "lessThan": "ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            },
            {
              "lessThan": "e3e3bf40916c1e810df03958cfa7ba6883cdce79",
              "status": "affected",
              "version": "39f8ea46724efbed3ca021863a22337c31be264c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/auxdisplay/charlcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nauxdisplay: charlcd: cancel backlight work on registration failure\n\nWith CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before\ncharlcd_register() calls misc_register(). If registration fails, the\ncaller frees the charlcd object while delayed work still contains its\naddress.\n\nAdd charlcd_deinit() to cancel the delayed work and turn the backlight\noff. Use it for both registration rollback and normal unregistration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - charlcd_register() is reached only from local auxdisplay probe (hd44780 platform, lcd2s I2C, panel parport) on character LCDs in embedded, industrial, and appliance systems; there is no network or USB-host packet path into this misc-registration error path.\nAC:L - CONFIG_CHARLCD_BL_FLASH is the default, so charlcd_init() always queues bl_work (L* poke, 4s) before misc_register(); a second charlcd consumer or LCD_MINOR 156 collision makes registration fail deterministically, then the work runs on the freed object with no attacker-uncontrollable race.\nPR:L - On multi-display or mixed hd44780/lcd2s/panel systems the second probe runs automatically at boot without init-namespace root, and an unprivileged local user can spray the heap in the 4s window; embedded/kiosk sysfs bind is also not strictly root-only. Uncertain vs High, so Low.\nUI:N - The UAF is armed during driver probe and consumed by the kernel workqueue; no victim needs to open /dev/lcd, mount a filesystem, or take any other interactive action.\nS:U - The delayed-work UAF corrupts in-kernel charlcd_priv/work_struct heap state and can escalate only within the host kernel; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - charlcd_bl_off() does container_of() on the freed delayed_work and reads priv fields, including lcd.ops, from reclaimable slab, giving a use-after-free kernel read primitive.\nI:H - The same callback invokes priv-\u003elcd.ops-\u003ebacklight on the freed object, so reclaiming the slab with a forged ops table yields a kernel function-pointer call, arbitrary write, and control-flow hijack.\nA:H - Running delayed work after charlcd_free() oopses or panics via mutex_lock on freed bl_tempo_lock or a wild ops pointer, even when the UAF is not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:12.853Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04"
        },
        {
          "url": "https://git.kernel.org/stable/c/22586432c1aba89d9bd33f3173408dac830f220b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eaed64a32e550daf0dc9549742b3ab9e41d984f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe7ba73dde94c5f413b1588cd444b49105015dda"
        },
        {
          "url": "https://git.kernel.org/stable/c/84858671842ae5857b9ed1202b62f9045373dcd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3e3bf40916c1e810df03958cfa7ba6883cdce79"
        }
      ],
      "title": "auxdisplay: charlcd: cancel backlight work on registration failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89585",
    "datePublished": "2026-09-11T19:44:50.592Z",
    "dateReserved": "2026-09-11T19:38:34.729Z",
    "dateUpdated": "2026-09-14T12:01:12.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89585",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.05991"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:49:38.000Z",
      "cve": "CVE-2026-89585",
      "id": "msrc_CVE-2026-89585",
      "initial_release_date": "2026-09-13T01:05:19.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "auxdisplay: charlcd: cancel backlight work on registration failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89585.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89585\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:42.910\",\"lastModified\":\"2026-09-14T13:19:12.737\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nauxdisplay: charlcd: cancel backlight work on registration failure\\n\\nWith CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before\\ncharlcd_register() calls misc_register(). If registration fails, the\\ncaller frees the charlcd object while delayed work still contains its\\naddress.\\n\\nAdd charlcd_deinit() to cancel the delayed work and turn the backlight\\noff. Use it for both registration rollback and normal unregistration.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/auxdisplay/charlcd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"22586432c1aba89d9bd33f3173408dac830f220b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"6eaed64a32e550daf0dc9549742b3ab9e41d984f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"fe7ba73dde94c5f413b1588cd444b49105015dda\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"84858671842ae5857b9ed1202b62f9045373dcd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39f8ea46724efbed3ca021863a22337c31be264c\",\"lessThan\":\"e3e3bf40916c1e810df03958cfa7ba6883cdce79\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/auxdisplay/charlcd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22586432c1aba89d9bd33f3173408dac830f220b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6eaed64a32e550daf0dc9549742b3ab9e41d984f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/84858671842ae5857b9ed1202b62f9045373dcd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cd97b3c68fe3c06c8067cc59d7dff976c5b7ea04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3e3bf40916c1e810df03958cfa7ba6883cdce79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe7ba73dde94c5f413b1588cd444b49105015dda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff2fb3c1e60cb247ea3e28c0ea0bea81c18f7755\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:58:25+00:00",
      "cve": "CVE-2026-89585",
      "id": "CVE-2026-89585",
      "initial_release_date": "2026-09-11T19:44:50.592000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free in auxdisplay charlcd component",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89585.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:01:50Z",
      "cve": "CVE-2026-89585",
      "id": "CVE-2026-89585",
      "initial_release_date": "2026-09-16T00:01:50Z",
      "product_status:known_affected": "335",
      "product_status:known_not_affected": "18",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89585",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89585.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.