Executive brief
The Linux kernel's ssd1307fb display driver performs synchronous I2C transfers (used to update OLED displays) from damage callback handlers that may run while the kernel has preemption disabled. This causes the kernel to attempt a sleeping operation (I2C transfer) from an atomic context, resulting in kernel scheduling warnings, potential deadlocks, and system instability.
Technical details
The vulnerability is a context violation in the ssd1307fb framebuffer driver. The fbdev damage callbacks (used to update the display when the framebuffer changes) run from the fbcon console code, which may execute while printk has disabled preemption for atomicity. The driver currently performs synchronous I2C transfers to update the SSD1307 OLED display directly from these callbacks, entering a sleeping code path from atomic context. This violates kernel scheduling guarantees and triggers BUG_ON warnings in the scheduler. The fix defers I2C transfers out of the damage callback path, scheduling them asynchronously to execute in preemptible context. No authentication or special privileges are required; the bug occurs during normal console/framebuffer operations.
Affected products
- Linux Linux kernel affected versions prior to the fix
Timeline
- 2026-09-11: disclosed