CVE-2026-89598

In the Linux kernel, the following vulnerability has been resolved:

fbdev: ssd1307fb: defer I2C transfers from damage callbacks

The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transfer path from atomic context.

A complete report from an RK3566 system follows:

[ 258.129004] watchdog: watchdog0: watchdog did not stop! [ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003 [ 258.129076] Modules linked in: algif hash algif skcipher af alg bnep binfmt misc lz4hc lz4 zram snd soc hdmi codec brcmfmac wcc hci uart fb ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd soc simple card motorcomm pwm fan snd soc simple card utils ssd130x spi nls iso8859 1 ssd130x btbcm drm shmem helper display connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd soc rockchip i2s tdm snd soc rk817 hantro vpu snd soc core snd compress snd pcm dmaengine v4l2 vp9 snd pcm v4l2 h264 rockchip rga snd timer rk crypto2 spi rockchip sfc videobuf2 dma contig snd sm3 generic v4l2 mem2mem videobuf2 dma sg dwmac rk sm3 soundcore videobuf2 memops videobuf2 v4l2 stmmac platform dw hdmi cec videodev videobuf2 common dw hdmi i2s audio stmmac rk817 charger pcs xpcs mc cpufreq dt sch fq codel ip tables x tables autofs4 [ 258.129215] Preemption disabled at: [ 258.129216] [] vprintk emit+0x11c/0x340 [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C 6.6.0-rc5-rockchip-rk356x #4 [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT) [ 258.129243] Call trace: [ 258.129245] dump backtrace+0xa0/0x128 [ 258.129252] show stack+0x20/0x38 [ 258.129256] dump stack lvl+0x60/0xb0 [ 258.129265] dump stack+0x18/0x28 [ 258.129269] schedule bug+0xa0/0xc8 [ 258.129274] schedule+0x9ac/0xd30 [ 258.129279] schedule+0x60/0x100 [ 258.129282] schedule timeout+0x194/0x338 [ 258.129289] rk3x i2c xfer common.isra.0+0x384/0x498 [ 258.129296] rk3x i2c xfer+0x20/0x60 [ 258.129300] i2c transfer+0x194/0x648 [ 258.129308] i2c transfer+0x9c/0x130 [ 258.129313] i2c transfer buffer flags+0x64/0x98 [ 258.129318] ssd1307fb update rect+0x42c/0x560 [ssd1307fb] [ 258.129334] ssd1307fb defio imageblit+0x34/0x50 [ssd1307fb] [ 258.129343] soft cursor+0x13c/0x210 [ 258.129350] bit cursor+0x2dc/0x550 [ 258.129354] fbcon cursor+0xec/0x108 [ 258.129359] hide cursor+0x44/0xc8 [ 258.129365] vt console print+0x398/0x3b0 [ 258.129370] console flush all.isra.0+0x17c/0x410 [ 258.129377] console unlock+0x4c/0x100 [ 258.129382] vprintk emit+0x1c8/0x340 [ 258.129386] vprintk default+0x40/0x58 [ 258.129389] vprintk+0xb8/0xd0 [ 258.129392] printk+0x68/0x98 [ 258.129398] watchdog release+0x170/0x230 [ 258.129404] fput+0xbc/0x288 [ 258.129409] fput sync+0x58/0x70 [ 258.129413] arm64 sys close+0x40/0x90 [ 258.129419] invoke syscall+0x4c/0x118 [ 258.129426] el0 svc common.constprop.0+0x48/0xf0 [ 258.129432] do el0 svc+0x24/0x38 [ 258.129437] el0 svc+0x48/0x100 [ 258.129443] el0t 64 sync handler+0xc0/0xc8 [ 258.129448] el0t 64 sync+0x190/0x198 [ 258.573087] ------------[ cut here ]------------ [ 258.573098] DEBUG LOCKS WARN ON(val > preempt count()) [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871 preempt count sub+0x9c/0x148 [ 258.573130] Modules linked in: algif hash algif skcipher af alg bnep binfmt misc lz4hc lz4 zram snd soc hdmi codec brcmfmac wcc hci uart fb ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd soc simple card motorcomm pwm fan snd soc simple card utils ssd130x spi nls iso8859 1 ssd130x btbcm drm shmem helper display connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd soc rockchip i2s tdm snd soc rk817 hantro vpu snd soc core snd compress snd pcm dmaengine v4l2 vp ---truncated---