[CVE-2026-89598][LOW] fbdev: ssd1307fb: defer I2C transfers from damage callbacks

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-89598
Priority: LOW
AL-KERNEL base severity: LOW
KPANIC flag: NO
Patch: fbdev: ssd1307fb: defer I2C transfers from damage callbacks
Commit: b64f3497a0cd7bbd26d6c268eebd217d8062fcee
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b64f3497a0cd7bbd26d6c268eebd217d8062fcee
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89598
Analysis date: Fri, 11 Sep 2026 21:54:59 -0400
ActionableScore: 2
ActionableScore lower bound: unknown
Actionable bucket: Ordinary Moderate
Manual review required: NO

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-89598 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89598

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: LOW
Manual review required: NO

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-89598	LOW	https://www.kernelcve.org/list/?q=CVE-2026-89598 CHECK WITH IMPACT FROM ORIG NN LOW	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';CWE-667;CWE-662;CWE-703;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L';BEST CVSS score: '4.7';DESCR 'The ssd1307fb framebuffer driver can perform synchronous I2C display updates from fbdev damage callbacks while printk or fbcon has disabled preemption. This enters a sleeping I2C transfer path from atomic context and can trigger scheduling while atomic warnings, preemption warnings, lockdep noise, or system responsiveness problems on affected OLED framebuffer systems. For the CVSS the PR:L is used because reliable triggering normally requires a local user or process that can write to the framebuffer or otherwise drive local console framebuffer activity. The issue is not network reachable and depends on specific hardware and fbdev console configuration. Impact is denial of service only through warnings, stalls, or local display update related instability, with no evidence of memory corruption, information disclosure, or privilege escalation.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 2)	YES	READ LOCK INIT WARNONLY HARDWARE LINUS 	NO	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=2
PrimitiveClass=CLASS_C
RealUAF=NO
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=NO
ImportantCandidate=NO
ManualReview=NO
AutoDowngradeAllowed=YES

1. ActionableScore

* Raw conservative score: 2
* Conservative score: 2
* Raw paranoid score: 2
* Paranoid score: 2
* Final recommended bucket: **Ordinary Moderate**::

No floor or cap changed the score.

2. Signal breakdown

Positive signals:

* +1: Invalid execution context. The driver performs synchronous I2C transfers from fbdev damage callbacks that may run while preemption is disabled by printk or fbcon.
* +1: Local availability impact. The supplied trace shows scheduling while atomic, preemption warnings, lockdep style warnings, dropped printk messages, and possible responsiveness degradation.

Negative or non-awarded signals:

* 0: No UAF, stale pointer, double release, refcount mutation, OOB access, arbitrary write, or controlled corruption is established.
* 0: No confidentiality or integrity impact is awarded because there is no disclosure path or unauthorized data modification.
* 0: No reliable kernel panic point is awarded. The evidence shows warnings and invalid scheduling context, not a demonstrated fatal host crash.
* 0: No remote reachability is awarded. The trigger is local framebuffer or console activity, not network packet processing.
* 0: No local unprivileged trigger is awarded because the complete permission model for framebuffer access, console activity, and printk triggering is not established from the supplied evidence.
* 0: No hardware rarity penalty is applied in arithmetic, but exposure is limited to systems using this specific ssd1307fb I2C OLED framebuffer driver.

3. Reachability analysis

The vulnerable path is reached when fbdev damage callbacks invoke display update code while fbcon or printk has disabled preemption. A plausible trigger is local console or framebuffer activity on a system using the ssd1307fb driver with an I2C attached OLED display.

Below host admin reachability is not fully established. Some systems may allow a logged in local user, compositor, display service, or framebuffer capable process to drive framebuffer updates, but the supplied evidence does not prove that the complete trigger is reachable by an ordinary unprivileged user. HostAdminRequired is therefore UNKNOWN rather than YES or NO.

No namespace scoped privilege is involved. There is no network namespace, user namespace, CAP_NET_ADMIN, or container scoped operation relevant to the complete trigger chain. Prior setup requires the affected hardware and driver to be present and used as an fbdev console or framebuffer device. There is no evidence of a remote trigger. There is no meaningful race exploitation requirement beyond the contextual condition that the callback runs while preemption is disabled.

4. Primitive and severity interpretation

The exact primitive is sleepable I2C transfer execution from atomic context. This is an invalid context and synchronization bug, not a memory lifetime or ownership bug.

There is no active structured stale object, no fixed stale storage, no cleanup UAF, and no concrete repeated release or refcount operation. The demonstrated consequence is scheduling while atomic warnings and possible local DoS or responsiveness degradation on affected display systems. Stronger consequences such as memory corruption, privilege escalation, information disclosure, or arbitrary kernel write are not supported.

PrimitiveClass is CLASS_C because the behavior is primarily crash or DoS style invalid state behavior without an independently useful corruption primitive. ImportantCandidate is NO because there is no kernel corruption, security boundary bypass, COW violation, authorization bypass, or unresolved lifetime primitive. AutoDowngradeAllowed is YES because the issue is constrained to local availability symptoms in a hardware specific framebuffer driver and does not require Important class manual preservation.

5. One-sentence report phrase

The ssd1307fb driver can perform sleeping I2C transfers from fbdev damage callbacks while printk or fbcon has disabled preemption, causing scheduling while atomic warnings and local availability impact on affected OLED framebuffer systems.

6. Manual review recommendation

NO MANUAL CHECK NEEDED

The issue is a constrained local DoS style invalid context bug with no evidence of memory corruption, UAF, privilege escalation, information disclosure, authorization bypass, or network reachability.

7. Call-site confidence

Call-site confidence: high

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: fbdev: ssd1307fb: defer I2C transfers from damage callbacks
Commit: b64f3497a0cd7bbd26d6c268eebd217d8062fcee
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b64f3497a0cd7bbd26d6c268eebd217d8062fcee

Commit description:

The fbdev damage callbacks may run from fbcon while printk has disabled
preemption.  They currently update the display synchronously, which enters
the sleeping I2C transfer path from atomic context.

A complete report from an RK3566 system follows:

  [  258.129004] watchdog: watchdog0: watchdog did not stop!
  [  258.129067] BUG: scheduling while atomic: systemd/1/0x00000003
  [  258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep
  binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart
  fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card
  motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1
  ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb
  brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm
  snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine
  v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2
  spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem
  videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2
  stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio
  stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables
  x_tables autofs4
  [  258.129215] Preemption disabled at:
  [  258.129216] [<ffff80008012f96c>] vprintk_emit+0x11c/0x340
  [  258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G         C
  6.6.0-rc5-rockchip-rk356x #4
  [  258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT)
  [  258.129243] Call trace:
  [  258.129245]  dump_backtrace+0xa0/0x128
  [  258.129252]  show_stack+0x20/0x38
  [  258.129256]  dump_stack_lvl+0x60/0xb0
  [  258.129265]  dump_stack+0x18/0x28
  [  258.129269]  __schedule_bug+0xa0/0xc8
  [  258.129274]  __schedule+0x9ac/0xd30
  [  258.129279]  schedule+0x60/0x100
  [  258.129282]  schedule_timeout+0x194/0x338
  [  258.129289]  rk3x_i2c_xfer_common.isra.0+0x384/0x498
  [  258.129296]  rk3x_i2c_xfer+0x20/0x60
  [  258.129300]  __i2c_transfer+0x194/0x648
  [  258.129308]  i2c_transfer+0x9c/0x130
  [  258.129313]  i2c_transfer_buffer_flags+0x64/0x98
  [  258.129318]  ssd1307fb_update_rect+0x42c/0x560 [ssd1307fb]
  [  258.129334]  ssd1307fb_defio_imageblit+0x34/0x50 [ssd1307fb]
  [  258.129343]  soft_cursor+0x13c/0x210
  [  258.129350]  bit_cursor+0x2dc/0x550
  [  258.129354]  fbcon_cursor+0xec/0x108
  [  258.129359]  hide_cursor+0x44/0xc8
  [  258.129365]  vt_console_print+0x398/0x3b0
  [  258.129370]  console_flush_all.isra.0+0x17c/0x410
  [  258.129377]  console_unlock+0x4c/0x100
  [  258.129382]  vprintk_emit+0x1c8/0x340
  [  258.129386]  vprintk_default+0x40/0x58
  [  258.129389]  vprintk+0xb8/0xd0
  [  258.129392]  _printk+0x68/0x98
  [  258.129398]  watchdog_release+0x170/0x230
  [  258.129404]  __fput+0xbc/0x288
  [  258.129409]  __fput_sync+0x58/0x70
  [  258.129413]  __arm64_sys_close+0x40/0x90
  [  258.129419]  invoke_syscall+0x4c/0x118
  [  258.129426]  el0_svc_common.constprop.0+0x48/0xf0
  [  258.129432]  do_el0_svc+0x24/0x38
  [  258.129437]  el0_svc+0x48/0x100
  [  258.129443]  el0t_64_sync_handler+0xc0/0xc8
  [  258.129448]  el0t_64_sync+0x190/0x198
  [  258.573087] ------------[ cut here ]------------
  [  258.573098] DEBUG_LOCKS_WARN_ON(val > preempt_count())
  [  258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871
  preempt_count_sub+0x9c/0x148
  [  258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep
  binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart
  fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card
  motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1
  ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb
  brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm
  snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine
  v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2
  spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem
  videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2
  stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio
  stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables
  x_tables autofs4

[Commit description truncated; see the upstream URL below]

Changed files:
  kernel/sched/core.c
  drivers/video/fbdev/ssd1307fb.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b64f3497a0cd7bbd26d6c268eebd217d8062fcee

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-89598 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89598

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS score: 4.7

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 2

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: LOW
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): LOW

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).