A failure during job submission in the Linux kernel accel/rocket driver can trigger rocket_job_put() before the job domain has been assigned. The cleanup path then calls rocket_iommu_domain_put(job->domain) with job->domain still NULL, causing a kernel-space null pointer dereference. This results in a kernel crash which interrupts services on the host. The flaw is a classic Null Pointer Dereference (CWE-476) and does not provide direct privilege escalation or remote code execution, but it can cause a local denial of service that affects the entire system. The impact is limited to kernel space and therefore requires local execution of the driver’s ioctl interface.

All Linux kernel binaries that include the accel/rocket driver without the commit that moves domain initialization before cleanup. Any distribution using a kernel build that predates the patch is vulnerable. The exact range of vulnerable kernel versions is not listed, but any kernel lacking the fix should be considered at risk.

The CVSS score of 5.5 denotes moderate severity. The EPSS score is reported as below 1%, indicating a very low probability that attackers will successfully exploit this issue. The vulnerability is not listed in CISA’s KEV catalog, so no widespread, actively used exploits are known. The likely attack vector is local: a user or process that can invoke the accel/rocket driver’s ioctl interface to submit jobs may trigger the failure path, leading to a kernel crash. Only local privilege is required, and remote exploitation is not presently feasible.