UBUNTU-CVE-2026-89598: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transfer path from atomic context. A complete report from an RK3566 system follows: [ 258.129004] watchdog: watchdog0: watchdog did not stop! [ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003 [ 258.129076] Modules linked in: algifhash algifskcipher afalg bnep binfmtmisc lz4hc lz4 zram sndsochdmicodec brcmfmacwcc hciuart fbssd1306(C) fbtft(C) btqca btrtl btintel btsdio sndsocsimplecard motorcomm pwmfan sndsocsimplecardutils ssd130xspi nlsiso88591 ssd130x btbcm drmshmemhelper displayconnector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill sndsocrockchipi2stdm sndsocrk817 hantrovpu sndsoccore sndcompress sndpcmdmaengine v4l2vp9 sndpcm v4l2h264 rockchiprga sndtimer rkcrypto2 spirockchipsfc videobuf2dmacontig snd sm3generic v4l2mem2mem videobuf2dmasg dwmacrk sm3 soundcore videobuf2memops videobuf2v4l2 stmmacplatform dwhdmicec videodev videobuf2common dwhdmii2saudio stmmac rk817charger pcsxpcs mc cpufreqdt schfqcodel iptables xtables autofs4 [ 258.129215] Preemption disabled at: [ 258.129216] [<ffff80008012f96c>] vprintkemit+0x11c/0x340 [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C 6.6.0-rc5-rockchip-rk356x #4 [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT) [ 258.129243] Call trace: [ 258.129245] dumpbacktrace+0xa0/0x128 [ 258.129252] showstack+0x20/0x38 [ 258.129256] dumpstacklvl+0x60/0xb0 [ 258.129265] dumpstack+0x18/0x28 [ 258.129269] schedulebug+0xa0/0xc8 [ 258.129274] schedule+0x9ac/0xd30 [ 258.129279] schedule+0x60/0x100 [ 258.129282] scheduletimeout+0x194/0x338 [ 258.129289] rk3xi2cxfercommon.isra.0+0x384/0x498 [ 258.129296] rk3xi2cxfer+0x20/0x60 [ 258.129300] i2ctransfer+0x194/0x648 [ 258.129308] i2ctransfer+0x9c/0x130 [ 258.129313] i2ctransferbufferflags+0x64/0x98 [ 258.129318] ssd1307fbupdaterect+0x42c/0x560 [ssd1307fb] [ 258.129334] ssd1307fbdefioimageblit+0x34/0x50 [ssd1307fb] [ 258.129343] softcursor+0x13c/0x210 [ 258.129350] bitcursor+0x2dc/0x550 [ 258.129354] fbconcursor+0xec/0x108 [ 258.129359] hidecursor+0x44/0xc8 [ 258.129365] vtconsoleprint+0x398/0x3b0 [ 258.129370] consoleflushall.isra.0+0x17c/0x410 [ 258.129377] consoleunlock+0x4c/0x100 [ 258.129382] vprintkemit+0x1c8/0x340 [ 258.129386] vprintkdefault+0x40/0x58 [ 258.129389] vprintk+0xb8/0xd0 [ 258.129392] printk+0x68/0x98 [ 258.129398] watchdogrelease+0x170/0x230 [ 258.129404] fput+0xbc/0x288 [ 258.129409] fputsync+0x58/0x70 [ 258.129413] arm64sysclose+0x40/0x90 [ 258.129419] invokesyscall+0x4c/0x118 [ 258.129426] el0svccommon.constprop.0+0x48/0xf0 [ 258.129432] doel0svc+0x24/0x38 [ 258.129437] el0svc+0x48/0x100 [ 258.129443] el0t64synchandler+0xc0/0xc8 [ 258.129448] el0t64sync+0x190/0x198 [ 258.573087] ------------[ cut here ]------------ [ 258.573098] DEBUGLOCKSWARNON(val > preemptcount()) [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871 preemptcountsub+0x9c/0x148 [ 258.573130] Modules linked in: algifhash algifskcipher afalg bnep binfmtmisc lz4hc lz4 zram sndsochdmicodec brcmfmacwcc hciuart fbssd1306(C) fbtft(C) btqca btrtl btintel btsdio sndsocsimplecard motorcomm pwmfan sndsocsimplecardutils ssd130xspi nlsiso88591 ssd130x btbcm drmshmemhelper displayconnector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill sndsocrockchipi2stdm sndsocrk817 hantrovpu sndsoccore sndcompress sndpcmdmaengine v4l2vp ---truncated---