CVE-2026-89585

Received Received - Intake

auxdisplay: charlcd backlight work cancellation flaw

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address. Add charlcd_deinit() to cancel the delayed work and turn the backlight off. Use it for both registration rollback and normal unregistration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89585

EUVD

EUVD-2026-76497

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the charlcd driver. When CONFIG_CHARLCD_BL_FLASH is enabled, the charlcd_init function schedules backlight work before the device registration completes. If registration fails, the system frees the charlcd object while delayed work still references it, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's auxdisplay subsystem and requires kernel configuration CONFIG_CHARLCD_BL_FLASH. Detection involves checking kernel configuration and module usage. Commands: grep CONFIG_CHARLCD_BL_FLASH /boot/config-$(uname -r); lsmod | grep charlcd; dmesg | grep charlcd

Impact Analysis

This vulnerability could lead to system instability, crashes, or unexpected behavior if the charlcd driver is used with CONFIG_CHARLCD_BL_FLASH enabled. Attackers might exploit this to cause denial-of-service conditions or execute arbitrary code with kernel privileges.

Mitigation Strategies

Apply the latest kernel update from your distribution to ensure the fix is included. If CONFIG_CHARLCD_BL_FLASH is not needed, disable it via kernel configuration. Reboot the system after changes.

Hi! I’m here to help you understand CVE-2026-89585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70