PT-2026-90308 · Linux · Linux
CVE-2026-89592
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix NULL dereference and integer overflow in rocket job push()
rocket job push() allocates a temporary array to hold all input and
output GEM object pointers:
bos = kvmalloc array(job->in bo count + job->out bo count,
sizeof(void *), GFP KERNEL);
memcpy(bos, job->in bos, job->in bo count * sizeof(void *));
memcpy(&bos[job->in bo count], job->out bos, ...);
Two bugs exist:
-
Missing NULL check: if kvmalloc array() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference.
-
Integer overflow: in bo count and out bo count are both u32, set directly from userspace-supplied in bo handle count and out bo handle count with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmalloc array() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array.
Fix by using check add overflow() to detect count overflow before the
allocation, and adding a NULL check on the allocation result.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux