CVE-2026-89598

What it actually does

The Linux kernel ssd1307fb framebuffer driver issued synchronous, sleeping I2C transfers from fbdev damage callbacks that can run in atomic context (for example when fbcon/printk has disabled preemption). That path violates atomicity rules, producing scheduling-while-atomic conditions, lockdep/preempt-count warnings, and possible kernel hangs or panics—a local denial of service on hosts using this SSD1306/SSD1307 OLED driver.

Why it matters to the business

Embedded Linux devices and single-board computers that drive small OLED panels through ssd1307fb may freeze or crash during ordinary console activity, taking down kiosks, industrial HMIs, or IoT appliances. Confidentiality and integrity are not affected. Urgency is low: the issue is not in CISA KEV, is not tied to ransomware, has exploit maturity of none, EPSS is about 0.0017 with no 30-day change, and the advisory is 37 days old.

How an attack unfolds

There is no remote network vector and no named threat-actor or campaign activity. On a system with ssd1307fb bound to an SSD1307-class I2C OLED, framebuffer damage callbacks (fbcon cursor blit or console print) may run after printk has disabled preemption. The unpatched driver then performs a blocking I2C transfer from that atomic section, the scheduler is entered while atomic, and the kernel may warn, hang, or panic. The public report was triggered by a watchdog close that printed to the console under systemd, showing that normal privileged activity—not a crafted payload—can induce the crash. A local user could increase crash likelihood by forcing console or framebuffer updates; there is no evidence of in-the-wild exploitation.

How to fix it

Install a Linux kernel that includes the upstream ssd1307fb fix deferring I2C transfers out of damage callbacks so display updates no longer run in atomic context. This record lists no distro or package versions; take the patched kernel from your vendor or a stable/LTS tree that contains that deferral. If an immediate upgrade is not possible, unload or blacklist ssd1307fb, do not bind the OLED, or disable fbcon on that framebuffer. Reboot onto the patched kernel after upgrade.

How to confirm the fix worked

Confirm the running kernel changelog or ssd1307fb source defers I2C work from damage callbacks instead of calling i2c_transfer in atomic context. Check whether ssd1307fb is loaded and whether an SSD1307-compatible panel is bound. After patching, generate console and fbcon activity and verify kernel logs no longer show scheduling-while-atomic traces through ssd1307fb_update_rect or ssd1307fb_defio_imageblit.

Typical attack path

1. Obtain local access to a Linux host that loads ssd1307fb against an SSD1306/SSD1307 OLED over I2C
2. Cause framebuffer or virtual-console updates (fbcon cursor, printk/vt output) while the kernel is in atomic context
3. Unpatched damage callback performs a sleeping I2C transfer from that context
4. Kernel hits scheduling-while-atomic and may hang or panic, denying availability

How to detect it

Search kernel logs (dmesg, journalctl -k, kern.log/messages) for scheduling-while-atomic or preempt-count lockdep warnings whose call traces include ssd1307fb_update_rect, ssd1307fb_defio_imageblit, fbcon_cursor, vt_console_print, or I2C xfer helpers originating in ssd1307fb. Note the process (often a console writer), hardware description, and modules list containing ssd1307fb. Matching oopses mean the bug fired locally; they do not imply remote intrusion. No network indicators or malware artifacts are associated.

• BUG: scheduling while atomic
• ssd1307fb_update_rect
• ssd1307fb_defio_imageblit
• [ssd1307fb]
• DEBUG_LOCKS_WARN_ON(val > preempt_count())
• fbcon_cursor
• vt_console_print
• i2c_transfer_buffer_flags
• rk3x_i2c_xfer

What your security team should do

• Treat this as a local availability issue, not a KEV or ransomware emergency; patch embedded/SBC fleets that load ssd1307fb on a normal kernel cadence
• Inventory systems with ssd1307fb loaded or SSD1306/SSD1307 OLEDs on I2C
• Until patched, blacklist ssd1307fb or disable fbcon on the affected display where operationally acceptable
• Alert on kernel oopses whose traces mention ssd1307fb_update_rect or scheduling while atomic with ssd1307fb
• Do not open incident response solely on this CVE unless matching oopses appear