CVE-2026-64008

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel Rocket Accelerator

Publication date: 2026-07-19

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-02

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-64008

EUVD

EUVD-2026-45581

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 6.18 (inc) to 6.18.35 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's accel/rocket driver. It occurs when a GEM handle is inserted into a file's IDR too early in the rocket_ioctl_create_bo() function. If subsequent operations fail, the error path frees the object without removing the handle, leaving a dangling pointer to freed memory. Later ioctls using this handle can then dereference this freed memory, causing a UAF.

Detection Guidance

This vulnerability is specific to the Linux kernel's accel/rocket driver and involves a use-after-free (UAF) condition via a dangling GEM handle. Detection requires checking for kernel logs or crashes related to the rocket_ioctl_create_bo function or drm_gem_handle_create operations. Monitor for kernel oops messages or system crashes during GPU buffer operations.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code or cause a denial of service by triggering the UAF condition. It affects systems using the affected Linux kernel components, potentially leading to system instability or privilege escalation.

Compliance Impact

This vulnerability is a use-after-free (UAF) flaw in the Linux kernel's accel/rocket driver, which could lead to memory corruption or arbitrary code execution. While it does not directly impact compliance with GDPR or HIPAA, such vulnerabilities may compromise system integrity, potentially leading to unauthorized data access or breaches. Compliance frameworks often require timely patching of critical vulnerabilities to maintain security controls.

Mitigation Strategies

Apply the Linux kernel patch that moves drm_gem_handle_create() to after all fallible operations succeed. Update to a kernel version containing the fix. If immediate patching is not possible, disable the rocket driver module (rocket.ko) to prevent exploitation until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64008. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70