The Linux kernel’s accel/rocket subsystem contains a vulnerability where rocket_job_push() allocates an array of GEM object pointers without validating the allocation result or checking for integer overflow. A failed allocation results in a NULL pointer dereference, and an overflow of the summed input and output counts can cause the allocation size to be smaller than intended, leading to out‑of‑bounds access of the temporary array. These issues are classic denial‑of‑service scenarios that ultimately cause a kernel crash, and they are rooted in an invalid pointer dereference weakness identified as CWE‑476.

All Linux kernel releases that include the accel/rocket subsystem prior to the fix commit a85402bff218f2b8f0d806e46c16c2f3d49cdda7 are affected. The vulnerability is part of the kernel core and is vendor‑agnostic.

The CVSS score of 6.1 reflects moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, implying limited evidence of active exploitation. The likely attack vector is local, as the failure conditions depend on user‑supplied counts passed to rocket_job_push. An attacker with the ability to invoke rocket_job_push may induce a crash, providing a local denial‑of‑service.