CVE-2026-98094
Analyzed
Analyzed - Analysis Complete
Race Condition in Linux Kernel FBTFT Subsystem
Vulnerability report for CVE-2026-98094, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-25
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
staging: fbtft: make dirty_lock IRQ-safe
fbtft_mkdirty() can be reached from the fbcon rendering path while
processing printk() in hardirq context. Meanwhile, dirty_lock is also
taken by fbtft_deferred_io() in workqueue context with local interrupts
enabled.
Lockdep reports a possible IRQ lock inversion involving dirty_lock and
console_owner. A hardirq can interrupt a CPU holding dirty_lock and
enter the console rendering path, which can attempt to acquire
dirty_lock again.
The following lockdep report was observed on an RK3566 system with
CONFIG_PROVE_LOCKING enabled:
WARNING: possible irq lock inversion dependency detected
swapper/2/0 just changed the state of lock:
(console_owner){-...}-{0:0}
but this lock took another, HARDIRQ-unsafe lock in the past:
(&par->dirty_lock){+.+.}-{2:2}
CPU0 CPU1
---- ----
lock(&par->dirty_lock);
local_irq_disable();
lock(console_owner);
lock(&par->dirty_lock);
<Interrupt>
lock(console_owner);
*** DEADLOCK ***
Use spin_lock_irqsave() for fbtft_mkdirty() and spin_lock_irq() for
fbtft_deferred_io(). They only access the dirty line range, so the
IRQ-off regions remain short.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.19 (inc) to 7.2.7 (exc) |
| linux | linux_kernel | 7.3 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.53 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.111 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.222 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.158 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.189 (exc) |
| linux | linux_kernel | From 4.0 (inc) to 5.10.271 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
