The Linux kernel’s accel/rocket subsystem contains a vulnerability where user‑supplied counts are used to allocate an array of GEM object pointers without validating the allocation result or checking for integer overflow. A failed allocation results in a NULL pointer dereference, and an overflow of the summed input and output counts can cause the allocation size to be smaller than intended, leading to out‑of‑bounds access of the temporary array. Both are classic denial‑of‑service scenarios.

All Linux kernel releases that include the accel/rocket subsystem prior to the fix commit (a85402bff218f2b8f0d806e46c16c2f3d49cdda7) are affected. The vulnerability is part of the kernel core version is vulnerable regardless of vendor.

The CVSS score of 6.1 reflects moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, implying limited evidence of active exploitation. The attack vector is likely local, as the failure conditions depend on user‑supplied buffer counts passed to the kernel. An attacker with the ability to invoke rocket_job_push may induce a crash, providing a local denial‑of‑service.