GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89597 (GCVE-0-2026-89597)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:01
VLAI
Title
fbdev: uvesafb: unregister connector callback on init failure
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered. The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < b149f77d04082a9da75944cdc488becb0e35258f (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < 0352fdac3cbf11e3b323322ff8cd95e20cbf5cd7 (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < 17518e7123f7ef01b1155064dc01f2087583908e (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < 9eb7b3cbe99c9c0edbff69eb155c723e30983c22 (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < 9f8a822b44c42502f105cf6574f4867067eecdd0 (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < 466a8af0dee2cf745307155e26884e19a37b7e15 (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < 9e768ae51426af2034d479133cfd73010d641b1a (git)
Affected: 8bdb3a2d7df48b861972c4bfb58490853a228f51 , < de8db23aa7c337e606fca9faf48b3ba72968597a (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/uvesafb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b149f77d04082a9da75944cdc488becb0e35258f",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "0352fdac3cbf11e3b323322ff8cd95e20cbf5cd7",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "17518e7123f7ef01b1155064dc01f2087583908e",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "9eb7b3cbe99c9c0edbff69eb155c723e30983c22",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "9f8a822b44c42502f105cf6574f4867067eecdd0",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "466a8af0dee2cf745307155e26884e19a37b7e15",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "9e768ae51426af2034d479133cfd73010d641b1a",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            },
            {
              "lessThan": "de8db23aa7c337e606fca9faf48b3ba72968597a",
              "status": "affected",
              "version": "8bdb3a2d7df48b861972c4bfb58490853a228f51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/uvesafb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: uvesafb: unregister connector callback on init failure\n\nuvesafb_init() registers the v86d connector callback before registering\nthe platform driver. If platform_driver_register() fails, the function\nreturns the error directly and leaves the connector callback registered.\n\nThe later platform-device failure path already unregisters the callback.\nAdd the same cleanup before the final return when platform-driver\nregistration fails.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The leftover v86d connector callback is reached only via a local NETLINK_CONNECTOR socket: cn_rx_skb() -\u003e cn_call_callback() invokes the registered handler. There is no remote packet, Bluetooth/WiFi, or USB path into this code.\nAC:L - Once platform_driver_register() fails, cn_add_callback() has already left uvesafb_cn_callback on the global connector list while free_module() unmaps the driver. A single NETLINK_CONNECTOR message with CN_IDX_V86D/CN_VAL_V86D_UVESAFB then calls that stale pointer with no race or other condition beyond the attacker\u0027s control.\nPR:L - Unprivileged users may create NETLINK_CONNECTOR sockets and send to kernel portid 0 without CAP_NET_ADMIN. The callback\u0027s capable(CAP_SYS_ADMIN) check never runs because the UAF occurs at the call through the freed module text, so init-namespace root is not required.\nUI:N - The attacker sends the netlink message from their own process. No separate victim action such as mounting a filesystem, opening a device node, or loading a module is required to hit the dangling callback.\nS:U - The stale function pointer and freed uvesafb module memory are kernel-side resources in the same security authority. This is local privilege escalation, not VM escape, IOMMU bypass, or another cross-boundary impact.\nC:H - The leftover cn_callback_entry still points at uvesafb_cn_callback in freed module text. That use-after-free lets an attacker reclaim the pages and obtain an arbitrary kernel read primitive.\nI:H - Calling through a function pointer that resides in freed module memory is a control-flow hijack once those pages are reallocated, giving an arbitrary write and code-execution primitive.\nA:H - Invoking the stale connector callback jumps into unmapped or reused module text and reliably oopses or panics the kernel even if the attacker does not fully exploit the UAF."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:20.325Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b149f77d04082a9da75944cdc488becb0e35258f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0352fdac3cbf11e3b323322ff8cd95e20cbf5cd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/17518e7123f7ef01b1155064dc01f2087583908e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9eb7b3cbe99c9c0edbff69eb155c723e30983c22"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f8a822b44c42502f105cf6574f4867067eecdd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/466a8af0dee2cf745307155e26884e19a37b7e15"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e768ae51426af2034d479133cfd73010d641b1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/de8db23aa7c337e606fca9faf48b3ba72968597a"
        }
      ],
      "title": "fbdev: uvesafb: unregister connector callback on init failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89597",
    "datePublished": "2026-09-11T19:44:59.538Z",
    "dateReserved": "2026-09-11T19:38:34.731Z",
    "dateUpdated": "2026-09-14T12:01:20.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89597",
      "date": "2026-09-17",
      "epss": "0.00164",
      "percentile": "0.06016"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:55:09.000Z",
      "cve": "CVE-2026-89597",
      "id": "msrc_CVE-2026-89597",
      "initial_release_date": "2026-09-13T01:08:29.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fbdev: uvesafb: unregister connector callback on init failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89597.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89597\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:44.463\",\"lastModified\":\"2026-09-14T13:19:13.827\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbdev: uvesafb: unregister connector callback on init failure\\n\\nuvesafb_init() registers the v86d connector callback before registering\\nthe platform driver. If platform_driver_register() fails, the function\\nreturns the error directly and leaves the connector callback registered.\\n\\nThe later platform-device failure path already unregisters the callback.\\nAdd the same cleanup before the final return when platform-driver\\nregistration fails.\\n\\nThis issue was identified during our ongoing static-analysis research while\\nreviewing kernel code.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/video/fbdev/uvesafb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"b149f77d04082a9da75944cdc488becb0e35258f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"0352fdac3cbf11e3b323322ff8cd95e20cbf5cd7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"17518e7123f7ef01b1155064dc01f2087583908e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"9eb7b3cbe99c9c0edbff69eb155c723e30983c22\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"9f8a822b44c42502f105cf6574f4867067eecdd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"466a8af0dee2cf745307155e26884e19a37b7e15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"9e768ae51426af2034d479133cfd73010d641b1a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bdb3a2d7df48b861972c4bfb58490853a228f51\",\"lessThan\":\"de8db23aa7c337e606fca9faf48b3ba72968597a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/video/fbdev/uvesafb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.24\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.24\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0352fdac3cbf11e3b323322ff8cd95e20cbf5cd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/17518e7123f7ef01b1155064dc01f2087583908e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/466a8af0dee2cf745307155e26884e19a37b7e15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e768ae51426af2034d479133cfd73010d641b1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9eb7b3cbe99c9c0edbff69eb155c723e30983c22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f8a822b44c42502f105cf6574f4867067eecdd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b149f77d04082a9da75944cdc488becb0e35258f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de8db23aa7c337e606fca9faf48b3ba72968597a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-13T07:01:15+00:00",
      "cve": "CVE-2026-89597",
      "id": "CVE-2026-89597",
      "initial_release_date": "2026-09-11T19:44:59.538000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel uvesafb: Resource leak due to improper callback unregistration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89597.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:01:46Z",
      "cve": "CVE-2026-89597",
      "id": "CVE-2026-89597",
      "initial_release_date": "2026-09-16T00:01:46Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "84",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89597",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89597.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.