CVE-2026-89585: auxdisplay: charlcd: cancel backlight work on registration failure
In the Linux kernel, the following vulnerability has been resolved:
auxdisplay: charlcd: cancel backlight work on registration failure
With CONFIGCHARLCDBLFLASH, charlcdinit() schedules blwork before charlcdregister() calls miscregister(). If registration fails, the caller frees the charlcd object while delayed work still contains its address.
Add charlcddeinit() to cancel the delayed work and turn the backlight off. Use it for both registration rollback and normal unregistration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When CONFIG_CHARLCD_BL_FLASH is enabled, ensure auxdisplay/charlcd cancels the delayed backlight work on registration failure.
Linux kernel (auxdisplay: charlcd) CONFIG_CHARLCD_BL_FLASH = enabled
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel charlcd auxiliary-display driver with CONFIG_CHARLCD_BL_FLASH enabled are exposed when charlcd device registration fails after backlight delayed work has been scheduled.
What condition is required to trigger the vulnerability?
The charlcd registration path must fail at misc_register() after charlcd_init() has scheduled bl_work. The failed-registration cleanup then frees the charlcd object while the pending delayed work still retains its address.
What should be done if the affected driver cannot be updated immediately?
Avoid configurations that enable CONFIG_CHARLCD_BL_FLASH or avoid triggering charlcd registration failures where possible. The provided fix cancels the delayed backlight work and turns off the backlight during registration rollback and normal unregistration.