CVE-2026-90316
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to these isrs giving chances of UAF of these objects if irqs are unregistered while they are handled, so better do not copy that table.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-17 17:17:29.443000
Last modified
2026-10-19 09:19:25.543000
View original CVE JSON
{
"id": "CVE-2026-90316",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-17T17:17:29.443",
"lastModified": "2026-10-19T09:19:25.543",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/omap: dsi: Do not copy isr table\n\nTo be able to unregister stuff from isrs, the corresponding table was\ncopied. Nobody seems to unregister stuff that way, so it does not help.\nBut there are stack-allocated objects passed to these isrs giving chances\nof UAF of these objects if irqs are unregistered while they are handled,\nso better do not copy that table."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/gpu/drm/omapdrm/dss/dsi.c",
"drivers/gpu/drm/omapdrm/dss/dsi.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "b3cbd1451c240446ce170f514244e1cb65ec0de4",
"versionType": "git",
"status": "affected"
},
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "f6733460b6d483dea7bfb5cfceb11cbff31a60b7",
"versionType": "git",
"status": "affected"
},
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "542a6a3ec77cd29f953987f7263f32fb8acb097e",
"versionType": "git",
"status": "affected"
},
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "2c27a84ba8d1bfed046d0067161d92001605accc",
"versionType": "git",
"status": "affected"
},
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "9063b30faae8ccaacf003735560df3956dbb592f",
"versionType": "git",
"status": "affected"
},
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "30810bdf273b4c93f8731b96a7204f33e052180d",
"versionType": "git",
"status": "affected"
},
{
"version": "4ae2ddddf44cd9f73def2dbdb68c6859072262ff",
"lessThan": "97c03b32b28a9f7f13f768f2b06e1eaafe850e66",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/gpu/drm/omapdrm/dss/dsi.c",
"drivers/gpu/drm/omapdrm/dss/dsi.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.39",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.39",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.110",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.52",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.6",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c27a84ba8d1bfed046d0067161d92001605accc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/30810bdf273b4c93f8731b96a7204f33e052180d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/542a6a3ec77cd29f953987f7263f32fb8acb097e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9063b30faae8ccaacf003735560df3956dbb592f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/97c03b32b28a9f7f13f768f2b06e1eaafe850e66",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b3cbd1451c240446ce170f514244e1cb65ec0de4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f6733460b6d483dea7bfb5cfceb11cbff31a60b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}