Executive brief
A vulnerability in the Linux kernel's Rocket accelerator driver could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system fails to properly clean up memory references during certain hardware acceleration tasks, leading to a 'use-after-free' condition. This could impact system stability and the security of data processed by the accelerator.
Technical details
A use-after-free (UAF) vulnerability exists in the rocket_ioctl_create_bo() function within the Linux kernel's accel/rocket driver. The function creates a GEM handle and inserts it into the file's IDR before completing all fallible operations (such as sgt allocation and iommu mapping). If a subsequent operation fails, the object is freed, but the handle remains in the IDR, pointing to freed memory. A local attacker can then trigger a UAF by calling other ioctls (PREP_BO, FINI_BO, SUBMIT) that reference the dangling handle. The fix involves reordering the handle creation to occur only after all fallible operations have succeeded.
Affected products
- Linux Linux 6.18, 7.0, 7.1
Timeline
- 2026-05-21: disclosed: Initial patch submitted by Dhabaleshwar Das
- 2026-07-19: advisory: CVE-2026-64008 published in NVD