PT-2026-90306 · Linux · Linux
CVE-2026-89590
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: Fix error path handling in rocket job run()
In rocket job run(), after taking an extra fence reference for
job->done fence via dma fence get(), the error paths have three bugs:
- The dma fence reference held by job->done fence is never released, causing a reference leak.
- pm runtime get sync() increments the usage counter even on failure, but the error path does not decrement it, leaking the runtime PM reference and preventing the NPU from suspending.
- A valid but unsignaled fence is returned to the DRM scheduler, which triggers WARN("Fence ... released with pending signals!") when the scheduler drops its reference.
Fix by replacing pm runtime get sync() with pm runtime resume and get()
which auto-balances the usage counter on failure, releasing both fence
references on error, and returning ERR PTR(ret) instead of the
unsignaled fence.
[tomeu: Refactored error paths to use consolidated goto labels]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux