CVE-2026-64008
Received Received - Intake

Use-After-Free in Linux Kernel Rocket Accelerator

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64008
EUVD
EUVD-2026-45581

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's accel/rocket driver. It occurs when a GEM handle is inserted into a file's IDR too early in the rocket_ioctl_create_bo() function. If subsequent operations fail, the error path frees the object without removing the handle, leaving a dangling pointer to freed memory. Later ioctls using this handle can then dereference this freed memory, causing a UAF.

Detection Guidance

This vulnerability is specific to the Linux kernel's accel/rocket driver and involves a use-after-free (UAF) condition via a dangling GEM handle. Detection requires checking for kernel logs or crashes related to the rocket_ioctl_create_bo function or drm_gem_handle_create operations. Monitor for kernel oops messages or system crashes during GPU buffer operations.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code or cause a denial of service by triggering the UAF condition. It affects systems using the affected Linux kernel components, potentially leading to system instability or privilege escalation.

Compliance Impact

This vulnerability is a use-after-free (UAF) flaw in the Linux kernel's accel/rocket driver, which could lead to memory corruption or arbitrary code execution. While it does not directly impact compliance with GDPR or HIPAA, such vulnerabilities may compromise system integrity, potentially leading to unauthorized data access or breaches. Compliance frameworks often require timely patching of critical vulnerabilities to maintain security controls.

Mitigation Strategies

Apply the Linux kernel patch that moves drm_gem_handle_create() to after all fallible operations succeed. Update to a kernel version containing the fix. If immediate patching is not possible, disable the rocket driver module (rocket.ko) to prevent exploitation until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart