GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89592 (GCVE-0-2026-89592)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-11 19:44
VLAI
Title
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
Summary
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() rocket_job_push() allocates a temporary array to hold all input and output GEM object pointers: bos = kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void *), GFP_KERNEL); memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *)); memcpy(&bos[job->in_bo_count], job->out_bos, ...); Two bugs exist: 1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference. 2. Integer overflow: in_bo_count and out_bo_count are both u32, set directly from userspace-supplied in_bo_handle_count and out_bo_handle_count with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmalloc_array() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array. Fix by using check_add_overflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0810d5ad88a18f1e6d549853a388ad0316f74e36 , < c1a5bf1b6e1d5944183dcef3844a18c17219af4d (git)
Affected: 0810d5ad88a18f1e6d549853a388ad0316f74e36 , < dfff90a6eb2258e3b867994ae17af4a7ba3504d2 (git)
Affected: 0810d5ad88a18f1e6d549853a388ad0316f74e36 , < a85402bff218f2b8f0d806e46c16c2f3d49cdda7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/rocket/rocket_job.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c1a5bf1b6e1d5944183dcef3844a18c17219af4d",
              "status": "affected",
              "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36",
              "versionType": "git"
            },
            {
              "lessThan": "dfff90a6eb2258e3b867994ae17af4a7ba3504d2",
              "status": "affected",
              "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36",
              "versionType": "git"
            },
            {
              "lessThan": "a85402bff218f2b8f0d806e46c16c2f3d49cdda7",
              "status": "affected",
              "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/rocket/rocket_job.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: fix NULL dereference and integer overflow in rocket_job_push()\n\nrocket_job_push() allocates a temporary array to hold all input and\noutput GEM object pointers:\n\n    bos = kvmalloc_array(job-\u003ein_bo_count + job-\u003eout_bo_count,\n                         sizeof(void *), GFP_KERNEL);\n    memcpy(bos, job-\u003ein_bos, job-\u003ein_bo_count * sizeof(void *));\n    memcpy(\u0026bos[job-\u003ein_bo_count], job-\u003eout_bos, ...);\n\nTwo bugs exist:\n\n1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and\n   the subsequent memcpy() dereferences it, causing a kernel NULL\n   pointer dereference.\n\n2. Integer overflow: in_bo_count and out_bo_count are both u32, set\n   directly from userspace-supplied in_bo_handle_count and\n   out_bo_handle_count with no prior validation. Their sum is computed\n   in u32 arithmetic and can wrap to a smaller value, causing the\n   allocation count passed to kvmalloc_array() to be smaller than\n   intended. Subsequent uses still operate on the original counts when\n   copying and locking objects, which may lead to out-of-bounds accesses\n   on the temporary array.\n\nFix by using check_add_overflow() to detect count overflow before the\nallocation, and adding a NULL check on the allocation result."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T19:44:55.813Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c1a5bf1b6e1d5944183dcef3844a18c17219af4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfff90a6eb2258e3b867994ae17af4a7ba3504d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a85402bff218f2b8f0d806e46c16c2f3d49cdda7"
        }
      ],
      "title": "accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89592",
    "datePublished": "2026-09-11T19:44:55.813Z",
    "dateReserved": "2026-09-11T19:38:34.730Z",
    "dateUpdated": "2026-09-11T19:44:55.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89592",
      "date": "2026-09-15",
      "epss": "0.00206",
      "percentile": "0.10916"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89592\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:43.807\",\"lastModified\":\"2026-09-11T20:19:43.807\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naccel/rocket: fix NULL dereference and integer overflow in rocket_job_push()\\n\\nrocket_job_push() allocates a temporary array to hold all input and\\noutput GEM object pointers:\\n\\n    bos = kvmalloc_array(job-\u003ein_bo_count + job-\u003eout_bo_count,\\n                         sizeof(void *), GFP_KERNEL);\\n    memcpy(bos, job-\u003ein_bos, job-\u003ein_bo_count * sizeof(void *));\\n    memcpy(\u0026bos[job-\u003ein_bo_count], job-\u003eout_bos, ...);\\n\\nTwo bugs exist:\\n\\n1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and\\n   the subsequent memcpy() dereferences it, causing a kernel NULL\\n   pointer dereference.\\n\\n2. Integer overflow: in_bo_count and out_bo_count are both u32, set\\n   directly from userspace-supplied in_bo_handle_count and\\n   out_bo_handle_count with no prior validation. Their sum is computed\\n   in u32 arithmetic and can wrap to a smaller value, causing the\\n   allocation count passed to kvmalloc_array() to be smaller than\\n   intended. Subsequent uses still operate on the original counts when\\n   copying and locking objects, which may lead to out-of-bounds accesses\\n   on the temporary array.\\n\\nFix by using check_add_overflow() to detect count overflow before the\\nallocation, and adding a NULL check on the allocation result.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/accel/rocket/rocket_job.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0810d5ad88a18f1e6d549853a388ad0316f74e36\",\"lessThan\":\"c1a5bf1b6e1d5944183dcef3844a18c17219af4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0810d5ad88a18f1e6d549853a388ad0316f74e36\",\"lessThan\":\"dfff90a6eb2258e3b867994ae17af4a7ba3504d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0810d5ad88a18f1e6d549853a388ad0316f74e36\",\"lessThan\":\"a85402bff218f2b8f0d806e46c16c2f3d49cdda7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/accel/rocket/rocket_job.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a85402bff218f2b8f0d806e46c16c2f3d49cdda7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1a5bf1b6e1d5944183dcef3844a18c17219af4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dfff90a6eb2258e3b867994ae17af4a7ba3504d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T04:48:37+00:00",
      "cve": "CVE-2026-89592",
      "id": "CVE-2026-89592",
      "initial_release_date": "2026-09-11T19:44:55.813000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: accel/rocket NULL dereference and integer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89592.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T00:58:07Z",
      "cve": "CVE-2026-89592",
      "id": "CVE-2026-89592",
      "initial_release_date": "2026-09-15T00:58:07Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89592",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89592.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.