# CVE-2026-89599

## Summary

- **CVE ID:** CVE-2026-89599
- **Severity:** HIGH
- **CVSS Score:** 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

dsicm_probe() registers the display before initializing ddata->lock.
Once omapdss_register_display() publishes the display, another consumer
can reach a dsicm callback that takes this mutex while it is still
uninitialized.

Initialize the mutex before registering the display so the published
callbacks always see a valid lock.

## Affected Products

- Linux — Linux (f76ee892a99e68b55402b8d4b8aeffcae2aff34d)
- Linux — Linux (4.5)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (5.10.270)
- Linux — Linux (5.15.221)
- Linux — Linux (6.1.188)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/2c3f8c9c995db185284b079f39177e85b2258176)
- [CNA](https://git.kernel.org/stable/c/76818e81cfcae33b09b739de09162c7d8d89bf0b)
- [CNA](https://git.kernel.org/stable/c/09db79078f25c048cfb5d7849795c70415ab8574)
- [CNA](https://git.kernel.org/stable/c/f8e43fe0f22b7137ce456e6fe3581d3098174f74)
- [CNA](https://git.kernel.org/stable/c/ef20d4e17d7fb0d83144caa9667e6f3198288993)
- [CNA](https://git.kernel.org/stable/c/e7023d18c4eb292f886b31a3576402cb0e357df7)
- [CNA](https://git.kernel.org/stable/c/f33a96e49284589257e90ddc4394ec0c6bf11ec4)
- [CNA](https://git.kernel.org/stable/c/302d19fbc7dc7e9f498930c66d65ff711ba5ba9f)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.14%
- **EPSS Percentile:** 4.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._