CVE-2026-98605
Received Received - Intake

Use-After-Free in Linux Kernel Samsung DSIM Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiod_get_optional() to devm_gpiod_get_optional() while keeping the matching gpiod_put() calls. That combination is wrong for a managed descriptor. However, dropping the puts and keeping the managed get is also wrong: samsung_dsim_register_te_irq() runs from the DSI host attach callback, and host detach/reattach can happen without destroying the device that owns the managed action. A second attach would then request the GPIO again without having released it. Switch back to a non-managed gpiod_get_optional() and keep the explicit gpiod_put() on the request_irq() error path and in samsung_dsim_unregister_te_irq(). [Luca: remove unnecessary comment]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98605
EUVD
EUVD-2026-103650

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux e7447128ca4a250374d6721ee98e3e3cf99551a6
Linux Linux e7447128ca4a250374d6721ee98e3e3cf99551a6
Linux Linux e7447128ca4a250374d6721ee98e3e3cf99551a6
Linux Linux e7447128ca4a250374d6721ee98e3e3cf99551a6
Linux Linux e7447128ca4a250374d6721ee98e3e3cf99551a6
Linux Linux 6.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Samsung DSI driver. It involves incorrect handling of a TE GPIO (likely a timing enable signal) when attaching and detaching the DSI host. The driver improperly uses managed GPIO functions, leading to potential double acquisition of the GPIO without proper release, which can cause system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/bridge samsung-dsim driver and relates to improper GPIO handling. Detection requires checking kernel logs for errors related to samsung-dsim or TE GPIO issues. Commands like dmesg | grep -i samsung-dsim or journalctl -k | grep -i samsung-dsim may help identify related errors.

Impact Analysis

If you use a system with the affected Linux kernel, this bug could cause crashes or system hangs when the DSI display interface is repeatedly attached or detached. This might happen during display mode changes, suspend/resume cycles, or hardware hotplug events.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If updating is not immediately possible, avoid detaching and reattaching DSI host devices to prevent triggering the vulnerability. Monitor kernel logs for related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart