CVE-2026-98605
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiod_get_optional() to devm_gpiod_get_optional() while keeping the matching gpiod_put() calls. That combination is wrong for a managed descriptor. However, dropping the puts and keeping the managed get is also wrong: samsung_dsim_register_te_irq() runs from the DSI host attach callback, and host detach/reattach can happen without destroying the device that owns the managed action. A second attach would then request the GPIO again without having released it. Switch back to a non-managed gpiod_get_optional() and keep the explicit gpiod_put() on the request_irq() error path and in samsung_dsim_unregister_te_irq(). [Luca: remove unnecessary comment]
Affected versions
Linux kernel versions
6.4
and later are affected. Fixed in
6.6.158,
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-98605?
CVE-2026-98605 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.4 onward and has been patched in 6.6.158, 6.12.112, 6.18.55 and others. CVE-2026-98605 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98605?
Yes. CVE-2026-98605 has been patched. Fixed versions include 6.6.158, 6.12.112, 6.18.55 and others. If you are running Linux kernel 6.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98605 actively exploited?
No. CVE-2026-98605 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.