Executive brief
The Linux kernel's Rocket accelerator driver contains a defect in its job submission handler that can lead to null pointer dereference during error cleanup. When job allocation fails early in the process, the cleanup code attempts to release a domain pointer that was never initialized, causing a kernel crash. This affects systems that use the Rocket accelerator for GPU workloads.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the Rocket accelerator's job submission IOCTL handler (`rocket_ioctl_submit_job`). The root cause is an initialization ordering issue: the job domain reference (`rjob->domain`) is assigned after task copying and BO (buffer object) lookups, but the error cleanup path (`rocket_job_cleanup`) unconditionally calls `rocket_iommu_domain_put(job->domain)` even when the domain pointer is null. An allocation or task-copy error occurring before domain initialization triggers cleanup of an uninitialized pointer. Additionally, a double-free issue exists where `rjob->tasks` can be freed twice if an error occurs in `rocket_copy_tasks()`. The fix moves domain initialization before error-prone operations and clears the tasks pointer after freeing. Exploitation requires local access to trigger device IOCTLs, and successful exploitation causes kernel panic (DoS).
Affected products
- Linux Linux kernel multiple versions; original defect introduced in commit 0810d5ad88a1
Timeline
- 2026-09-11: disclosed: CVE-2026-89591 published
- 2026-07-01: patched: Fix authored by Shuvam Pandey
- 2026-09-07: patched: Fix merged into stable kernel trees