CVE-2026-89591

accel/rocket: initialize job domain before cleanup paths

Published Sep 11, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: initialize job domain before cleanup paths

rocket_ioctl_submit_job() releases rjob through rocket_job_put() on
allocation error paths. rocket_job_cleanup() unconditionally calls
rocket_iommu_domain_put(job->domain), but job->domain is assigned only
after task copying and BO lookups. A failure before that assignment can
therefore clean up a job with a NULL domain pointer.

Take the per-file domain reference before the first error path can release
rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so
the common cleanup path cannot free the task array again after a task-copy
error.

Analysis

Technical impact

During an error that occurs before the accel/rocket task domain is assigned, the driver’s cleanup routine calls the kernel function to release the domain pointer. Because that pointer is null at that time, the call dereferences a null pointer in kernel space, causing the operating system to crash. The crash results in a blanket denial of service for the entire host, as normal kernel operation cannot continue.

Affected Systems

Linux kernel ships containing the accel/rocket driver before the commit that initializes the job domain before cleanup are vulnerable. All distributions and custom kernel builds that have not yet incorporated this patch, or that still use the older driver code, fall into this category.

Risk and Exploitability

The CVSS score of 5.5 classifies this flaw as moderate severity, while the EPSS score of <1% suggests a very low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits. Based on the description, it is inferred that an attacker would need local access to the accel/rocket device’s ioctl interface and be able to provoke the error that triggers the null dereference in the cleanup path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0810d5ad88a18f1e6d549853a388ad0316f74e36`	affected	< 3043230296653a609ab50006899e64bbb2d99465
`0810d5ad88a18f1e6d549853a388ad0316f74e36`	affected	< 81731f1eda5e6a1dfad31445f741de9bbefbb08e
`0810d5ad88a18f1e6d549853a388ad0316f74e36`	affected	< 70e6a33d68a9b03335c5426332666e52d07f45d6

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[0810d5ad88a18f1e6d549853a388ad0316f74e36,3043230296653a609ab50006899e64bbb2d99465)`	affected	code_commit	—
`[0810d5ad88a18f1e6d549853a388ad0316f74e36,81731f1eda5e6a1dfad31445f741de9bbefbb08e)`	affected	code_commit	—
`[0810d5ad88a18f1e6d549853a388ad0316f74e36,70e6a33d68a9b03335c5426332666e52d07f45d6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a release that includes the commit which initializes the job domain before cleanup.
If an immediate kernel upgrade is not feasible, cherry‑pick or apply the specific commit to the current source tree, recompile the kernel, and reboot into the patched image.
Restrict the device file exposed by the accel/rocket driver to trusted, privileged users only, limiting the number of processes that can invoke the problematic ioctl path.

Generated by OpenCVE AI on September 15, 2026 at 22:05 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3043230296653a609ab50006899e64bbb2d99465
https://git.kernel.org/stable/c/70e6a33d68a9b03335c5426332666e52d07f45d6
https://git.kernel.org/stable/c/81731f1eda5e6a1dfad31445f741de9bbefbb08e
https://nvd.nist.gov/vuln/detail/CVE-2026-89591
https://www.cve.org/CVERecord?id=CVE-2026-89591

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89591 https://www.cve.org/CVERecord?id=CVE-2026-89591
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket_ioctl_submit_job() releases rjob through rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can therefore clean up a job with a NULL domain pointer. Take the per-file domain reference before the first error path can release rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so the common cleanup path cannot free the task array again after a task-copy error.
Title		accel/rocket: initialize job domain before cleanup paths
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3043230296653a609ab50006899e64bbb2d99465 https://git.kernel.org/stable/c/70e6a33d68a9b03335c5426332666e52d07f45d6 https://git.kernel.org/stable/c/81731f1eda5e6a1dfad31445f741de9bbefbb08e