CVE-2026-89585: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89585 Overview

CVE-2026-89585 is a use-after-free vulnerability in the Linux kernel's auxdisplay character LCD (charlcd) driver. When built with CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules a delayed backlight work item (bl_work) before charlcd_register() invokes misc_register(). If registration fails, the caller frees the charlcd object while the delayed work still references its memory. The fix introduces charlcd_deinit() to cancel the pending work and disable the backlight during both registration rollback and normal teardown.

Critical Impact
A local attacker with the ability to trigger charlcd registration failure can achieve use-after-free conditions leading to kernel memory corruption, privilege escalation, or denial of service.

Affected Products

Linux kernel builds with CONFIG_CHARLCD_BL_FLASH enabled
drivers/auxdisplay/charlcd.c subsystem
Multiple stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89585 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89585

Vulnerability Analysis

The defect resides in the initialization and teardown sequence of the charlcd auxiliary display driver. With CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules bl_work as a delayed workqueue item to flash the backlight. The registration path then calls charlcd_register(), which invokes misc_register() to expose the character device.

When misc_register() fails, control returns to the caller, which frees the charlcd object. However, the previously scheduled bl_work remains queued and holds a pointer to the now-freed memory. When the workqueue later dispatches bl_work, it dereferences freed memory, producing a classic use-after-free condition in kernel context.

The upstream remediation adds a charlcd_deinit() helper that cancels the delayed work and turns the backlight off. This helper runs on both the registration failure path and normal unregistration, closing the race between object lifetime and pending work execution.

Root Cause

The root cause is missing lifecycle synchronization between an initialized workqueue item and the object it references. The driver scheduled asynchronous work before completing registration, without a symmetric cleanup path when registration failed.

Attack Vector

Exploitation requires local access with the ability to load or interact with the charlcd driver and induce a registration failure. Successful exploitation of the resulting use-after-free may allow kernel memory corruption, escalation to root, or a kernel panic denial of service.

No proof-of-concept exploit code is publicly available. For technical details, refer to the upstream commits listed under Kernel Git Commit 22586432 and Kernel Git Commit ff2fb3c1.

Detection Methods for CVE-2026-89585

Indicators of Compromise

Kernel oops or panic messages referencing bl_work, charlcd, or workqueue dispatch in dmesg
KASAN reports flagging use-after-free in drivers/auxdisplay/charlcd.c
Unexpected module load or probe failures for charlcd-dependent hardware drivers

Detection Strategies

Enable KASAN (CONFIG_KASAN) on test kernels to surface use-after-free access during charlcd registration failure paths
Audit installed kernel versions against the fixed commits published on kernel.org for each stable branch
Correlate module load events with subsequent kernel warnings tied to auxiliary display drivers

Monitoring Recommendations

Forward kernel ring buffer output to a central logging pipeline for review of oops, WARN, and KASAN entries
Monitor privileged process creation and unexpected root shells that could follow kernel memory corruption
Track kernel package versions across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-89585

Immediate Actions Required

Apply the stable kernel updates that include the charlcd_deinit() fix from the referenced upstream commits
Inventory systems built with CONFIG_CHARLCD_BL_FLASH and prioritize them for patching
Restrict local access on affected systems until the patched kernel is deployed

Patch Information

The Linux kernel maintainers merged the fix across multiple stable branches. Reference commits include 22586432, 6eaed64a, 84858671, cd97b3c6, e3e3bf40, fe7ba73d, and ff2fb3c1 on git.kernel.org. Rebuild affected kernels or install vendor-provided packages that incorporate these commits.

Workarounds

Rebuild the kernel with CONFIG_CHARLCD_BL_FLASH disabled if the flashing backlight feature is not required
Do not load the charlcd driver on systems that do not require auxiliary character LCD support
Limit local user access and enforce least-privilege policies to reduce the pool of potential attackers

bash

# Verify running kernel and charlcd configuration
uname -r
grep CONFIG_CHARLCD /boot/config-$(uname -r)

# Prevent charlcd module from loading if not required
echo "blacklist charlcd" | sudo tee /etc/modprobe.d/blacklist-charlcd.conf
sudo update-initramfs -u