CVE-2026-98094

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: fbtft: make dirty_lock IRQ-safe

fbtft_mkdirty() can be reached from the fbcon rendering path while

processing printk() in hardirq context. Meanwhile, dirty_lock is also

taken by fbtft_deferred_io() in workqueue context with local interrupts

enabled.

Lockdep reports a possible IRQ lock inversion involving dirty_lock and

console_owner. A hardirq can interrupt a CPU holding dirty_lock and

enter the console rendering path, which can attempt to acquire

dirty_lock again.

The following lockdep report was observed on an RK3566 system with

CONFIG_PROVE_LOCKING enabled:

WARNING: possible irq lock inversion dependency detected

swapper/2/0 just changed the state of lock:

(console_owner){-...}-{0:0}

but this lock took another, HARDIRQ-unsafe lock in the past:

(&par->dirty_lock){+.+.}-{2:2}

CPU0 CPU1

---- ----

lock(&par->dirty_lock);

local_

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References