Executive brief
The Linux kernel's OMAP display driver for DSI panels has a race condition where the display is registered with the system before the internal synchronization lock is initialized. An attacker or concurrent process could access display callbacks before the lock is ready, potentially causing a system crash or kernel panic. This affects systems using OMAP-based displays, particularly on embedded and mobile platforms.
Technical details
The vulnerability is a race condition in the OMAP DSI panel driver's dsicm_probe() function. The root cause is that omapdss_register_display() publishes the display before mutex_init(&ddata->lock) is called. Once registered, another thread or consumer can invoke dsicm callbacks that attempt to acquire the uninitialized mutex, leading to undefined behavior. The fix reorders the initialization sequence: mutex_init() is now called before omapdss_register_display(). This ensures the lock is valid before any published callbacks are reachable. No user interaction or authentication is required; the vulnerability is exploitable on any system with concurrent access to the registered display.
Affected products
- Linux Linux kernel Upstream; backported to stable series
Timeline
- 2026-09-11: disclosed
- 2026-08-18: patched: Fix committed by Runyu Xiao
- 2026-09-07: other: Patch merged to stable tree by Greg Kroah-Hartman