CVE-2026-89591

Received Received - Intake

Use-After-Free in Linux Kernel Rocket Accelerator

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket_ioctl_submit_job() releases rjob through rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can therefore clean up a job with a NULL domain pointer. Take the per-file domain reference before the first error path can release rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so the common cleanup path cannot free the task array again after a task-copy error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89591

EUVD

EUVD-2026-76503

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper initialization of a job domain before cleanup paths. When an error occurs during job submission, the system may attempt to clean up a job with a NULL domain pointer, leading to potential undefined behavior or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's accel/rocket subsystem and may not have direct detection commands. Monitor kernel logs for errors related to rocket_ioctl_submit_job or rocket_job_cleanup. Check for crashes or hangs in GPU acceleration tasks.

Impact Analysis

This vulnerability could cause system instability or crashes if exploited, particularly in environments using the affected Linux kernel component. It may lead to denial-of-service conditions or unexpected behavior in applications relying on the rocket_ioctl_submit_job functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel memory management issue with no clear impact on data protection or privacy requirements.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, disable the rocket acceleration subsystem by removing the relevant kernel module or restricting access to ioctl operations.

Hi! I’m here to help you understand CVE-2026-89591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70