CVE-2026-89585

A flaw was found in the auxdisplay: charlcd component of the Linux kernel. This use-after-free vulnerability occurs when the charlcd_register() function fails, leading to the charlcd object being freed while a delayed work item still retains its address. A local attacker could potentially exploit this to cause a system crash or other undefined behavior.

A use-after-free flaw was found in the Linux kernel's auxdisplay charlcd driver, rated by Red Hat as moderate severity. When the kernel is built with CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules the delayed backlight work before charlcd_register() calls misc_register(); if registration subsequently fails, the caller frees the charlcd object while the delayed work item still holds its address. A local attacker able to trigger this registration-failure path could exploit the stale reference to cause a system crash or other undefined behavior, resulting in denial of service. Red Hat's assessment found no confidentiality or integrity impact (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs from the CVE.org severity of 7.8 (Important), which assumes full confidentiality, integrity, and availability impact. Most Red Hat products evaluated for this flaw are not affected because the vulnerable code is not present in their shipped kernels. The affected Red Hat kernel offerings have the fix deferred to a future update, and the residual risk is considered limited because exploitation requires local access on a system using the charlcd auxdisplay driver with the CONFIG_CHARLCD_BL_FLASH backlight option enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.