All vulnerabilities
CVE-2026-98094

Linux: staging: fbtft: make dirty_lock IRQ-safe

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0843298b159599ee7bc6d14800efdb4bc7349706Also 10cc145b873670438d3b105133dffdae70822db6, 2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0843298b159599ee7bc6d14800efdb4bc7349706LinuxCVE List
  • 10cc145b873670438d3b105133dffdae70822db6LinuxCVE List
  • 2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: fbtft: make dirty_lock IRQ-safe

fbtft_mkdirty() can be reached from the fbcon rendering path while processing printk() in hardirq context. Meanwhile, dirty_lock is also taken by fbtft_deferred_io() in workqueue context with local interrupts enabled.

Lockdep reports a possible IRQ lock inversion involving dirty_lock and console_owner. A hardirq can interrupt a CPU holding dirty_lock and enter the console rendering path, which can attempt to acquire dirty_lock again.

The following lockdep report was observed on an RK3566 system with CONFIG_PROVE_LOCKING enabled:

WARNING: possible irq lock inversion dependency detected swapper/2/0 just changed the state of lock: (console_owner){-...}-{0:0} but this lock took another, HARDIRQ-unsafe lock in the past: (&par->dirty_lock){+.+.}-{2:2}

CPU0 CPU1 ---- ---- lock(&par->dirty_lock); local_irq_disable(); lock(console_owner); lock(&par->dirty_lock); <Interrupt> lock(console_owner);

* DEADLOCK *

Use spin_lock_irqsave() for fbtft_mkdirty() and spin_lock_irq() for fbtft_deferred_io(). They only access the dirty line range, so the IRQ-off regions remain short.

Text from CVE List

Affected versions 18

  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before 0843298b159599ee7bc6d14800efdb4bc7349706CVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before a323066337ed85c38decfc7f6bbf42f27605dff1CVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before f2451e18826eb6a33ea51419f39bdd2eb99fa1eaCVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before 10cc145b873670438d3b105133dffdae70822db6CVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before 2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7CVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before f0c869df2c33793c8828acaab3e4a5e0176f9f00CVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before dcb48fde8003492256dee45815144aa5ed26ce7cCVE List
  • Linuxaffected: c296d5f9957c03994a699d6739c27d4581a9f6c7 before f576944a59f31bcffff121117ebf452c5dd162b7CVE List
  • Linuxaffected: 4.0CVE List
  • Linuxunaffected: all versions before 4.0CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8