FKIE_CVE-2026-89598

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-10-30 13:20
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transfer path from atomic context. A complete report from an RK3566 system follows: [ 258.129004] watchdog: watchdog0: watchdog did not stop! [ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003 [ 258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1 ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2 spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2 stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables x_tables autofs4 [ 258.129215] Preemption disabled at: [ 258.129216] [<ffff80008012f96c>] vprintk_emit+0x11c/0x340 [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C 6.6.0-rc5-rockchip-rk356x #4 [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT) [ 258.129243] Call trace: [ 258.129245] dump_backtrace+0xa0/0x128 [ 258.129252] show_stack+0x20/0x38 [ 258.129256] dump_stack_lvl+0x60/0xb0 [ 258.129265] dump_stack+0x18/0x28 [ 258.129269] __schedule_bug+0xa0/0xc8 [ 258.129274] __schedule+0x9ac/0xd30 [ 258.129279] schedule+0x60/0x100 [ 258.129282] schedule_timeout+0x194/0x338 [ 258.129289] rk3x_i2c_xfer_common.isra.0+0x384/0x498 [ 258.129296] rk3x_i2c_xfer+0x20/0x60 [ 258.129300] __i2c_transfer+0x194/0x648 [ 258.129308] i2c_transfer+0x9c/0x130 [ 258.129313] i2c_transfer_buffer_flags+0x64/0x98 [ 258.129318] ssd1307fb_update_rect+0x42c/0x560 [ssd1307fb] [ 258.129334] ssd1307fb_defio_imageblit+0x34/0x50 [ssd1307fb] [ 258.129343] soft_cursor+0x13c/0x210 [ 258.129350] bit_cursor+0x2dc/0x550 [ 258.129354] fbcon_cursor+0xec/0x108 [ 258.129359] hide_cursor+0x44/0xc8 [ 258.129365] vt_console_print+0x398/0x3b0 [ 258.129370] console_flush_all.isra.0+0x17c/0x410 [ 258.129377] console_unlock+0x4c/0x100 [ 258.129382] vprintk_emit+0x1c8/0x340 [ 258.129386] vprintk_default+0x40/0x58 [ 258.129389] vprintk+0xb8/0xd0 [ 258.129392] _printk+0x68/0x98 [ 258.129398] watchdog_release+0x170/0x230 [ 258.129404] __fput+0xbc/0x288 [ 258.129409] __fput_sync+0x58/0x70 [ 258.129413] __arm64_sys_close+0x40/0x90 [ 258.129419] invoke_syscall+0x4c/0x118 [ 258.129426] el0_svc_common.constprop.0+0x48/0xf0 [ 258.129432] do_el0_svc+0x24/0x38 [ 258.129437] el0_svc+0x48/0x100 [ 258.129443] el0t_64_sync_handler+0xc0/0xc8 [ 258.129448] el0t_64_sync+0x190/0x198 [ 258.573087] ------------[ cut here ]------------ [ 258.573098] DEBUG_LOCKS_WARN_ON(val > preempt_count()) [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871 preempt_count_sub+0x9c/0x148 [ 258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1 ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine v4l2_vp ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1981e54ac137f773fb25a7209a42b75213868306
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/237924f5b9afc93b57c87bc8efc5ea2e687855e4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3bcab9b21f71d52bd1b2e03b80f29516bb000593
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9ad709afdfa32509ed64938a6d9cd00db3cd54c2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ab8c8e027fa8f9314340a96999dd3309b7f80d61
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b64f3497a0cd7bbd26d6c268eebd217d8062fcee
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/ssd1307fb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab8c8e027fa8f9314340a96999dd3309b7f80d61",
              "status": "affected",
              "version": "a2ed00da5047806233e288b991d9be997a5eb214",
              "versionType": "git"
            },
            {
              "lessThan": "237924f5b9afc93b57c87bc8efc5ea2e687855e4",
              "status": "affected",
              "version": "a2ed00da5047806233e288b991d9be997a5eb214",
              "versionType": "git"
            },
            {
              "lessThan": "b64f3497a0cd7bbd26d6c268eebd217d8062fcee",
              "status": "affected",
              "version": "a2ed00da5047806233e288b991d9be997a5eb214",
              "versionType": "git"
            },
            {
              "lessThan": "3bcab9b21f71d52bd1b2e03b80f29516bb000593",
              "status": "affected",
              "version": "a2ed00da5047806233e288b991d9be997a5eb214",
              "versionType": "git"
            },
            {
              "lessThan": "1981e54ac137f773fb25a7209a42b75213868306",
              "status": "affected",
              "version": "a2ed00da5047806233e288b991d9be997a5eb214",
              "versionType": "git"
            },
            {
              "lessThan": "9ad709afdfa32509ed64938a6d9cd00db3cd54c2",
              "status": "affected",
              "version": "a2ed00da5047806233e288b991d9be997a5eb214",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/ssd1307fb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: ssd1307fb: defer I2C transfers from damage callbacks\n\nThe fbdev damage callbacks may run from fbcon while printk has disabled\npreemption.  They currently update the display synchronously, which enters\nthe sleeping I2C transfer path from atomic context.\n\nA complete report from an RK3566 system follows:\n\n  [  258.129004] watchdog: watchdog0: watchdog did not stop!\n  [  258.129067] BUG: scheduling while atomic: systemd/1/0x00000003\n  [  258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep\n  binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart\n  fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card\n  motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1\n  ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb\n  brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm\n  snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine\n  v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2\n  spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem\n  videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2\n  stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio\n  stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables\n  x_tables autofs4\n  [  258.129215] Preemption disabled at:\n  [  258.129216] [\u003cffff80008012f96c\u003e] vprintk_emit+0x11c/0x340\n  [  258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G         C\n  6.6.0-rc5-rockchip-rk356x #4\n  [  258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT)\n  [  258.129243] Call trace:\n  [  258.129245]  dump_backtrace+0xa0/0x128\n  [  258.129252]  show_stack+0x20/0x38\n  [  258.129256]  dump_stack_lvl+0x60/0xb0\n  [  258.129265]  dump_stack+0x18/0x28\n  [  258.129269]  __schedule_bug+0xa0/0xc8\n  [  258.129274]  __schedule+0x9ac/0xd30\n  [  258.129279]  schedule+0x60/0x100\n  [  258.129282]  schedule_timeout+0x194/0x338\n  [  258.129289]  rk3x_i2c_xfer_common.isra.0+0x384/0x498\n  [  258.129296]  rk3x_i2c_xfer+0x20/0x60\n  [  258.129300]  __i2c_transfer+0x194/0x648\n  [  258.129308]  i2c_transfer+0x9c/0x130\n  [  258.129313]  i2c_transfer_buffer_flags+0x64/0x98\n  [  258.129318]  ssd1307fb_update_rect+0x42c/0x560 [ssd1307fb]\n  [  258.129334]  ssd1307fb_defio_imageblit+0x34/0x50 [ssd1307fb]\n  [  258.129343]  soft_cursor+0x13c/0x210\n  [  258.129350]  bit_cursor+0x2dc/0x550\n  [  258.129354]  fbcon_cursor+0xec/0x108\n  [  258.129359]  hide_cursor+0x44/0xc8\n  [  258.129365]  vt_console_print+0x398/0x3b0\n  [  258.129370]  console_flush_all.isra.0+0x17c/0x410\n  [  258.129377]  console_unlock+0x4c/0x100\n  [  258.129382]  vprintk_emit+0x1c8/0x340\n  [  258.129386]  vprintk_default+0x40/0x58\n  [  258.129389]  vprintk+0xb8/0xd0\n  [  258.129392]  _printk+0x68/0x98\n  [  258.129398]  watchdog_release+0x170/0x230\n  [  258.129404]  __fput+0xbc/0x288\n  [  258.129409]  __fput_sync+0x58/0x70\n  [  258.129413]  __arm64_sys_close+0x40/0x90\n  [  258.129419]  invoke_syscall+0x4c/0x118\n  [  258.129426]  el0_svc_common.constprop.0+0x48/0xf0\n  [  258.129432]  do_el0_svc+0x24/0x38\n  [  258.129437]  el0_svc+0x48/0x100\n  [  258.129443]  el0t_64_sync_handler+0xc0/0xc8\n  [  258.129448]  el0t_64_sync+0x190/0x198\n  [  258.573087] ------------[ cut here ]------------\n  [  258.573098] DEBUG_LOCKS_WARN_ON(val \u003e preempt_count())\n  [  258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871\n  preempt_count_sub+0x9c/0x148\n  [  258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep\n  binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart\n  fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card\n  motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1\n  ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb\n  brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm\n  snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine\n  v4l2_vp\n---truncated---"
    }
  ],
  "id": "CVE-2026-89598",
  "lastModified": "2026-10-30T13:20:22.403",
  "metrics": {},
  "published": "2026-09-11T20:19:44.583",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1981e54ac137f773fb25a7209a42b75213868306"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/237924f5b9afc93b57c87bc8efc5ea2e687855e4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3bcab9b21f71d52bd1b2e03b80f29516bb000593"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9ad709afdfa32509ed64938a6d9cd00db3cd54c2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ab8c8e027fa8f9314340a96999dd3309b7f80d61"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b64f3497a0cd7bbd26d6c268eebd217d8062fcee"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.