CVE-2026-89592

accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

Published Sep 11, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

rocket_job_push() allocates a temporary array to hold all input and
output GEM object pointers:

bos = kvmalloc_array(job->in_bo_count + job->out_bo_count,
sizeof(void *), GFP_KERNEL);
memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *));
memcpy(&bos[job->in_bo_count], job->out_bos, ...);

Two bugs exist:

1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and
the subsequent memcpy() dereferences it, causing a kernel NULL
pointer dereference.

2. Integer overflow: in_bo_count and out_bo_count are both u32, set
directly from userspace-supplied in_bo_handle_count and
out_bo_handle_count with no prior validation. Their sum is computed
in u32 arithmetic and can wrap to a smaller value, causing the
allocation count passed to kvmalloc_array() to be smaller than
intended. Subsequent uses still operate on the original counts when
copying and locking objects, which may lead to out-of-bounds accesses
on the temporary array.

Fix by using check_add_overflow() to detect count overflow before the
allocation, and adding a NULL check on the allocation result.

Analysis

Technical impact

The Linux kernel’s accel/rocket subsystem contains a vulnerability where rocket_job_push() allocates an array of GEM object pointers without validating the allocation result or checking for integer overflow. A failed allocation results in a NULL pointer dereference, and an overflow of the summed input and output counts can cause the allocation size to be smaller than intended, leading to out‑of‑bounds access of the temporary array. These issues are classic denial‑of‑service scenarios that ultimately cause a kernel crash, and they are rooted in an invalid pointer dereference weakness identified as CWE‑476.

Affected Systems

All Linux kernel releases that include the accel/rocket subsystem prior to the fix commit a85402bff218f2b8f0d806e46c16c2f3d49cdda7 are affected. The vulnerability is part of the kernel core and is vendor‑agnostic.

Risk and Exploitability

The CVSS score of 6.1 reflects moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, implying limited evidence of active exploitation. The likely attack vector is local, as the failure conditions depend on user‑supplied counts passed to rocket_job_push. An attacker with the ability to invoke rocket_job_push may induce a crash, providing a local denial‑of‑service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0810d5ad88a18f1e6d549853a388ad0316f74e36`	affected	< c1a5bf1b6e1d5944183dcef3844a18c17219af4d
`0810d5ad88a18f1e6d549853a388ad0316f74e36`	affected	< dfff90a6eb2258e3b867994ae17af4a7ba3504d2
`0810d5ad88a18f1e6d549853a388ad0316f74e36`	affected	< a85402bff218f2b8f0d806e46c16c2f3d49cdda7

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[0810d5ad88a18f1e6d549853a388ad0316f74e36,c1a5bf1b6e1d5944183dcef3844a18c17219af4d)`	affected	code_commit	—
`[0810d5ad88a18f1e6d549853a388ad0316f74e36,dfff90a6eb2258e3b867994ae17af4a7ba3504d2)`	affected	code_commit	—
`[0810d5ad88a18f1e6d549853a388ad0316f74e36,a85402bff218f2b8f0d806e46c16c2f3d49cdda7)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel update that contains commit a85402bff218f2b8f0d806e46c16c2f3d49cdda7
If an immediate kernel update is not feasible, disable the accel/rocket subsystem or prevent applications from calling rocket_job_push
Validate or constrain the in_bo_handle_count and out_bo_handle_count before they are passed to the kernel, ensuring that the summed count cannot overflow a 32‑bit value

Generated by OpenCVE AI on September 15, 2026 at 21:32 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/a85402bff218f2b8f0d806e46c16c2f3d49cdda7
https://git.kernel.org/stable/c/c1a5bf1b6e1d5944183dcef3844a18c17219af4d
https://git.kernel.org/stable/c/dfff90a6eb2258e3b867994ae17af4a7ba3504d2
https://nvd.nist.gov/vuln/detail/CVE-2026-89592
https://www.cve.org/CVERecord?id=CVE-2026-89592

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89592 https://www.cve.org/CVERecord?id=CVE-2026-89592
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() rocket_job_push() allocates a temporary array to hold all input and output GEM object pointers: bos = kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void ), GFP_KERNEL); memcpy(bos, job->in_bos, job->in_bo_count sizeof(void *)); memcpy(&bos[job->in_bo_count], job->out_bos, ...); Two bugs exist: 1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference. 2. Integer overflow: in_bo_count and out_bo_count are both u32, set directly from userspace-supplied in_bo_handle_count and out_bo_handle_count with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmalloc_array() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array. Fix by using check_add_overflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
Title		accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/a85402bff218f2b8f0d806e46c16c2f3d49cdda7 https://git.kernel.org/stable/c/c1a5bf1b6e1d5944183dcef3844a18c17219af4d https://git.kernel.org/stable/c/dfff90a6eb2258e3b867994ae17af4a7ba3504d2