CVE-2026-89598: fbdev: ssd1307fb: defer I2C transfers from damage callbacks
In the Linux kernel, the following vulnerability has been resolved:
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transfer path from atomic context.
A complete report from an RK3566 system follows:
[ 258.129004] watchdog: watchdog0: watchdog did not stop! [ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003 [ 258.129076] Modules linked in: algifhash algifskcipher afalg bnep binfmtmisc lz4hc lz4 zram sndsochdmicodec brcmfmacwcc hciuart fbssd1306(C) fbtft(C) btqca btrtl btintel btsdio sndsocsimplecard motorcomm pwmfan sndsocsimplecardutils ssd130xspi nlsiso88591 ssd130x btbcm drmshmemhelper displayconnector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill sndsocrockchipi2stdm sndsocrk817 hantrovpu sndsoccore sndcompress sndpcmdmaengine v4l2vp9 sndpcm v4l2h264 rockchiprga sndtimer rkcrypto2 spirockchipsfc videobuf2dmacontig snd sm3generic v4l2mem2mem videobuf2dmasg dwmacrk sm3 soundcore videobuf2memops videobuf2v4l2 stmmacplatform dwhdmicec videodev videobuf2common dwhdmii2saudio stmmac rk817charger pcsxpcs mc cpufreqdt schfqcodel iptables xtables autofs4 [ 258.129215] Preemption disabled at: [ 258.129216] [<ffff80008012f96c>] vprintkemit+0x11c/0x340 [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C 6.6.0-rc5-rockchip-rk356x #4 [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT) [ 258.129243] Call trace: [ 258.129245] dumpbacktrace+0xa0/0x128 [ 258.129252] showstack+0x20/0x38 [ 258.129256] dumpstacklvl+0x60/0xb0 [ 258.129265] dumpstack+0x18/0x28 [ 258.129269] schedulebug+0xa0/0xc8 [ 258.129274] schedule+0x9ac/0xd30 [ 258.129279] schedule+0x60/0x100 [ 258.129282] scheduletimeout+0x194/0x338 [ 258.129289] rk3xi2cxfercommon.isra.0+0x384/0x498 [ 258.129296] rk3xi2cxfer+0x20/0x60 [ 258.129300] i2ctransfer+0x194/0x648 [ 258.129308] i2ctransfer+0x9c/0x130 [ 258.129313] i2ctransferbufferflags+0x64/0x98 [ 258.129318] ssd1307fbupdaterect+0x42c/0x560 [ssd1307fb] [ 258.129334] ssd1307fbdefioimageblit+0x34/0x50 [ssd1307fb] [ 258.129343] softcursor+0x13c/0x210 [ 258.129350] bitcursor+0x2dc/0x550 [ 258.129354] fbconcursor+0xec/0x108 [ 258.129359] hidecursor+0x44/0xc8 [ 258.129365] vtconsoleprint+0x398/0x3b0 [ 258.129370] consoleflushall.isra.0+0x17c/0x410 [ 258.129377] consoleunlock+0x4c/0x100 [ 258.129382] vprintkemit+0x1c8/0x340 [ 258.129386] vprintkdefault+0x40/0x58 [ 258.129389] vprintk+0xb8/0xd0 [ 258.129392] printk+0x68/0x98 [ 258.129398] watchdogrelease+0x170/0x230 [ 258.129404] fput+0xbc/0x288 [ 258.129409] fputsync+0x58/0x70 [ 258.129413] arm64sysclose+0x40/0x90 [ 258.129419] invokesyscall+0x4c/0x118 [ 258.129426] el0svccommon.constprop.0+0x48/0xf0 [ 258.129432] doel0svc+0x24/0x38 [ 258.129437] el0svc+0x48/0x100 [ 258.129443] el0t64synchandler+0xc0/0xc8 [ 258.129448] el0t64sync+0x190/0x198 [ 258.573087] ------------[ cut here ]------------ [ 258.573098] DEBUGLOCKSWARNON(val > preemptcount()) [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871 preemptcountsub+0x9c/0x148 [ 258.573130] Modules linked in: algifhash algifskcipher afalg bnep binfmtmisc lz4hc lz4 zram sndsochdmicodec brcmfmacwcc hciuart fbssd1306(C) fbtft(C) btqca btrtl btintel btsdio sndsocsimplecard motorcomm pwmfan sndsocsimplecardutils ssd130xspi nlsiso88591 ssd130x btbcm drmshmemhelper displayconnector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill sndsocrockchipi2stdm sndsocrk817 hantrovpu sndsoccore sndcompress sndpcmdmaengine v4l2vp ---truncated---
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ssd1307fb framebuffer driver are exposed when fbdev damage callbacks update the display over I2C. The reported failure occurred on an RK3566 system, but the issue is described in the driver’s callback and I2C transfer behavior rather than as specific to that platform.
What condition triggers the failure?
The failure can occur when fbcon invokes an fbdev damage callback while printk has disabled preemption. The driver then performs a synchronous, sleeping I2C transfer from atomic context, resulting in a "scheduling while atomic" bug.
How can I identify an affected system?
Kernel logs may contain a "BUG: scheduling while atomic" report associated with display updates, along with a stack or module list showing ssd1307fb. The supplied report also includes a watchdog message indicating that watchdog0 did not stop.
What is the remediation?
Apply a kernel update containing the fix that defers I2C transfers out of damage callbacks. The provided stable kernel references identify commits carrying the resolution.