Cloudanix VulnDB

CVE-2026-90316

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel manages certain display hardware interrupts could let someone already on the device gain full system control or crash it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel DRM OMAP DSI driver ISR table handling, where stack-allocated objects passed to IRQs can be dereferenced after unregistration due to unnecessary table copying.

Why it matters to the business

Local attackers on affected Linux systems may achieve kernel-level code execution or cause system crashes, risking data exposure or service disruption on OMAP-based embedded or mobile devices.

How an attack unfolds

An attacker with local access crafts conditions to unregister IRQs while handlers execute, triggering use-after-free on stack objects referenced via the copied ISR table in the dsi driver.

How to fix it

Apply the upstream kernel patch that removes the ISR table copy in drm/omap/dsi; rebuild and deploy updated kernel images to all affected systems.

How to confirm the fix worked

Inspect kernel source for removal of the table copy logic in dsi.c; verify running kernel version includes the fix commit and test IRQ registration paths for absence of UAF.

Typical attack path

  1. Obtain local user access on target Linux system
  2. Load or trigger OMAP DSI display/IRQ paths
  3. Force IRQ unregistration concurrent with active handler execution
  4. Exploit resulting UAF for memory corruption or privilege escalation

How to detect it

Review kernel logs and crash dumps for UAF reports or oops involving drm/omap dsi ISR handling; correlate with processes triggering display or IRQ changes.

What your security team should do

  • Prioritize kernel updates on all OMAP DSI-enabled devices within standard patch windows
  • Monitor upstream Linux kernel changelogs for related DSI driver fixes
  • Restrict local access where possible on embedded OMAP platforms until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to these isrs giving chances of UAF of these objects if irqs are unregistered while they are handled, so better do not copy that table.

Affected packages

Ecosystem Package Introduced Fixed