CVE-2026-89592

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description The rocket job push() function contains a NULL pointer dereference and an integer overflow. The function allocates a temporary array to store input and output GEM object pointers. A failure in the kvmalloc array() allocation leads to a NULL pointer dereference during the subsequent memcpy() operation. Additionally, because in bo count and out bo count are u32 values supplied by userspace without validation, their sum can overflow. This results in an allocation smaller than required, leading to out-of-bounds accesses when copying and locking objects.

Recommendations Update to version 7.2.6-1.1 or later.