NVD / CVE Program· CNA Linux

CVE-2026-98094: staging: fbtft: make dirty_lock IRQ-safe

MediumCVSS 5.5 · v3.1—No exploit Fix available

Noroxi assessment

Priority: Monitor (action score 22/100)

The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
Probability of exploitation in the next 30 days: 0.09% (FIRST EPSS).
Someone with local access to the system can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
Fixed version: Linux Linux 0843298b159599ee7bc6d14800efdb4bc7349706, 10cc145b873670438d3b105133dffdae70822db6, 2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 6.6.158.1-1.
Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).

Low priority for now. Upgrade to Linux Linux 0843298b159599ee7bc6d14800efdb4bc7349706, 10cc145b873670438d3b105133dffdae70822db6, 2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 6.6.158.1-1 or later.

Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it

Primary sources: NVD · CVE.org · FIRST EPSS

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirty_lock IRQ-safe fbtft_mkdirty() can be reached from the fbcon rendering path while processing printk() in hardirq context. Meanwhile, dirty_lock is also taken by fbtft_deferred_io() in workqueue context with local interrupts enabled. Lockdep reports a possible IRQ lock inversion involving dirty_lock and console_owner. A hardirq can interrupt a CPU holding dirty_lock and enter the console rendering path, which can attempt to acquire dirty_lock again. The following lockdep report was observed on an RK3566 system with CONFIG_PROVE_LOCKING enabled: WARNING: possible irq lock inversion dependency detected swapper/2/0 just changed the state of lock: (console_owner){-...}-{0:0} but this lock took another, HARDIRQ-unsafe lock in the past: (&par->dirty_lock){+.+.}-{2:2} CPU0 CPU1 ---- ---- lock(&par->dirty_lock); local_irq_disable(); lock(console_owner); lock(&par->dirty_lock); <Interrupt> lock(console_owner); *** DEADLOCK *** Use spin_lock_irqsave() for fbtft_mkdirty() and spin_lock_irq() for fbtft_deferred_io(). They only access the dirty line range, so the IRQ-off regions remain short.

Denial of service

EUVD-2026-86924

Published: Sep 25, 2026
Updated: Oct 23, 2026
EPSS: 0.0% · 0th percentile
CWE: CWE-667

Report tools

JSON

Action score

Monitor

Low priority for now.

CVSS: 22 / 40 · 5.5 / 10
CISA KEV: 0 / 30 · Not listed
EPSS: 0 / 30 · 0.0%

Get told when this record changes

Not in KEV: no record of exploitation in the wild
No public exploit code on record
A fix has been released

If any of these changes, we'll tell you in the daily email digest.

Is your version affected? Check it

Noroxi analysis

What does it mean in your environment?

The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.

We use this product, ask for help

Affected systems

Is your version affected?

Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.

Vendor	Product	CPE
linux	linux kernel	cpe:2.3:o:linux:linux_kernel

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

Linux Linux
- 4.0affected
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before 0843298b159599ee7bc6d14800efdb4bc7349706affected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before a323066337ed85c38decfc7f6bbf42f27605dff1affected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before f2451e18826eb6a33ea51419f39bdd2eb99fa1eaaffected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before 10cc145b873670438d3b105133dffdae70822db6affected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before 2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7affected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before f0c869df2c33793c8828acaab3e4a5e0176f9f00affected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before dcb48fde8003492256dee45815144aa5ed26ce7caffected · git
- c296d5f9957c03994a699d6739c27d4581a9f6c7 and later · before f576944a59f31bcffff121117ebf452c5dd162b7affected · git
- before 4.0not affected · semver

Affected versions · NVD (8)

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

linux linux kernel4.0 and later · before 5.10.271
linux linux kernel5.11 and later · before 5.15.222
linux linux kernel5.16 and later · before 6.1.189
linux linux kernel6.2 and later · before 6.6.158
linux linux kernel6.7 and later · before 6.12.111
linux linux kernel6.13 and later · before 6.18.53
linux linux kernel6.19 and later · before 7.2.7
linux linux kernel7.3

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Ecosystem	Package	Affected range	Fix
Debian:12	linux	before 6.1.190-1	6.1.190-1
Debian:12	linux-6.12	before 6.12.111-1~deb12u1	6.12.111-1~deb12u1
Debian:13	linux	before 6.12.111-1	6.12.111-1
Debian:14	linux	before 7.2.7-1	7.2.7-1

Same product

linux: all records

Other highest-scoring records for the same primary product.

CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
90Now
CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
89Now
CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
85Now

Published before and after this one in the same product

← EarlierCVE-2026-98092Sep 25, 2026 · ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
22Monitor
← EarlierCVE-2026-98093Sep 25, 2026 · ASoC: fsl_micfil: balance mclk enable/disable
31Monitor
Later →CVE-2026-98095Sep 25, 2026 · af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
22Monitor

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

Product / package	Fixed version	Source
Linux Linux	0843298b159599ee7bc6d14800efdb4bc7349706	Vendor (CNA)
Linux Linux	10cc145b873670438d3b105133dffdae70822db6	Vendor (CNA)
Linux Linux	2a609e29efbba79f9abd68c4ec8a2bd7ecf291e7	Vendor (CNA)
Linux Linux	a323066337ed85c38decfc7f6bbf42f27605dff1	Vendor (CNA)
Linux Linux	dcb48fde8003492256dee45815144aa5ed26ce7c	Vendor (CNA)
Linux Linux	f0c869df2c33793c8828acaab3e4a5e0176f9f00	Vendor (CNA)
Linux Linux	f2451e18826eb6a33ea51419f39bdd2eb99fa1ea	Vendor (CNA)
Linux Linux	f576944a59f31bcffff121117ebf452c5dd162b7	Vendor (CNA)
azl3 kernel 6.6.157.1-1 on Azure Linux 3.0	6.6.158.1-1 · Release Notes	Microsoft (MSRC)
debian:linux	6.1.190-1 · Debian:12	Package registry (OSV)
debian:linux	6.12.111-1 · Debian:13	Package registry (OSV)
debian:linux-6.12	6.12.111-1~deb12u1 · Debian:12	Package registry (OSV)

Exploit status

No known public exploit

No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.