Junglewise Threat Intelligence

CVE-2026-89592: Linux kernel Rocket accelerator NULL dereference and integer overflow

CVE-2026-89592 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's Rocket accelerator driver contains a flaw in job submission that can cause a kernel crash or memory corruption. A local attacker can trigger a NULL pointer dereference or integer overflow by submitting specially crafted job requests, leading to denial of service or potential privilege escalation.

Technical details

The vulnerability exists in rocket_job_push() function which allocates a temporary array to hold GEM object pointers. Two distinct bugs occur: (1) Missing NULL check—if kvmalloc_array() fails due to memory pressure, the function proceeds to dereference the NULL pointer in subsequent memcpy() calls, causing a kernel panic; (2) Integer overflow—the in_bo_count and out_bo_count fields (u32, user-controlled) are summed in u32 arithmetic without overflow checking, allowing the sum to wrap to a smaller value. This undersized allocation is paired with operations that use the original unchecked counts, leading to out-of-bounds array accesses. The fix applies check_add_overflow() before allocation and adds explicit NULL checks, preventing both crash vectors.

Affected products

  • Linux Linux kernel various versions before patch (fix committed 2026-05-24)

Timeline

  • 2026-09-11: disclosed: CVE-2026-89592 published
  • 2026-05-24: patched: Fix committed upstream (a85402bff218f2b8f0d806e46c16c2f3d49cdda7)
  • 2026-07-04: other: Merged by Tomeu Vizoso

References

Related threats