Executive brief
The Linux kernel's uvesafb framebuffer driver fails to properly clean up a registered callback when driver initialization fails, leaving the callback active in memory. An attacker or buggy code could trigger this initialization failure and exploit the orphaned callback to read or write kernel memory, potentially leading to privilege escalation or system crash.
Technical details
This is a resource-cleanup vulnerability in the uvesafb_init() function in drivers/video/fbdev/uvesafb.c. The function registers a v86d connector callback via cn_add_callback() before calling platform_driver_register(). If platform_driver_register() fails, the function returns the error code without unregistering the callback, leaving it active. A later platform-device failure path correctly unregisters the callback, but the platform-driver failure path does not. The fix adds a conditional call to cn_del_callback() before the final return when err is non-zero, ensuring cleanup in all failure paths. The vulnerability requires no special authentication and is triggered during module load when platform driver registration fails.
Affected products
- Linux Linux kernel Affected versions span from the introduction of uvesafb in early 2.6 kernels through at least 6.x; patched in stable branches via commit 0352fdac3cbf11e3b323322ff8cd95e20cbf5cd7
Timeline
- 2026-09-11: disclosed: CVE-2026-89597 published
- 2026-09-14: patched: Patch committed to stable kernels by Greg Kroah-Hartman