CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: initialize job domain before cleanup paths

rocket ioctl submit job() releases rjob through rocket job put() on allocation error paths. rocket job cleanup() unconditionally calls rocket iommu domain put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can therefore clean up a job with a NULL domain pointer.

Take the per-file domain reference before the first error path can release rjob. Also clear rjob->tasks after freeing it in rocket copy tasks(), so the common cleanup path cannot free the task array again after a task-copy error.