Executive brief
The Linux kernel's Rocket accelerator driver contains a flaw in job submission that can cause a kernel crash or memory corruption. A local attacker can trigger a NULL pointer dereference or integer overflow by submitting specially crafted job requests, leading to denial of service or potential privilege escalation.
Technical details
The vulnerability exists in rocket_job_push() function which allocates a temporary array to hold GEM object pointers. Two distinct bugs occur: (1) Missing NULL check—if kvmalloc_array() fails due to memory pressure, the function proceeds to dereference the NULL pointer in subsequent memcpy() calls, causing a kernel panic; (2) Integer overflow—the in_bo_count and out_bo_count fields (u32, user-controlled) are summed in u32 arithmetic without overflow checking, allowing the sum to wrap to a smaller value. This undersized allocation is paired with operations that use the original unchecked counts, leading to out-of-bounds array accesses. The fix applies check_add_overflow() before allocation and adds explicit NULL checks, preventing both crash vectors.
Affected products
- Linux Linux kernel various versions before patch (fix committed 2026-05-24)
Timeline
- 2026-09-11: disclosed: CVE-2026-89592 published
- 2026-05-24: patched: Fix committed upstream (a85402bff218f2b8f0d806e46c16c2f3d49cdda7)
- 2026-07-04: other: Merged by Tomeu Vizoso