Improper resource shutdown or release in Linux kernel - CVE-2026-89597

Vulnerability details

The vulnerability allows a local privileged user to leave a v86d connector callback registered after initialization fails.

The vulnerability exists due to improper resource shutdown or release in uvesafb_init() when platform driver registration fails after registering the v86d connector callback. A local privileged user can initialize uvesafb to leave the callback registered.

Affected software

How to mitigate CVE-2026-89597

External References

• https://git.kernel.org/stable/c/466a8af0dee2cf745307155e26884e19a37b7e15
• https://git.kernel.org/stable/c/9e768ae51426af2034d479133cfd73010d641b1a
• https://git.kernel.org/stable/c/9f8a822b44c42502f105cf6574f4867067eecdd0
• https://git.kernel.org/stable/c/de8db23aa7c337e606fca9faf48b3ba72968597a

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel video fbdev driver