CVE-2026-64008: accel/rocket: fix UAF via dangling GEM handle in create_bo
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix UAF via dangling GEM handle in createbo
rocketioctlcreatebo() inserts a GEM handle into the file's IDR via drmgemhandlecreate() early on, then performs several operations that can fail (sgt allocation, drmmm insert, iommumap). If any fail after the handle is live, the error path calls drmgemshmemobjectfree() which kfree's the object without removing the handle from the IDR.
This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREPBO, FINIBO, SUBMIT) calls drmgemobjectlookup() and dereferences freed memory (UAF).
Fix by moving drmgemhandlecreate() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv.
Also fix drmmminsertnodegeneric() whose return value was silently overwritten by iommumapsgtable() on the next line. Add the missing error check.
[tomeu: Move handle creation to the very end]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Move drm_gem_handle_create() in rocket_ioctl_create_bo() to after all fallible operations, including sgt allocation, drm_mm insertion, and iommu_map, so an error cannot leave a dangling GEM handle.
- Compensating control
Check and handle the return value of drm_mm_insert_node_generic() in rocket_ioctl_create_bo().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64008?
CVE-2026-64008 has a risk rating of 60.
What does CVE-2026-64008 affect?
CVE-2026-64008 affects the Linux kernel, specifically the accel/rocket component.
How do I fix CVE-2026-64008?
To fix CVE-2026-64008, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-64008?
CVE-2026-64008 is a use-after-free (UAF) vulnerability caused by a dangling GEM handle.
What is the impact of CVE-2026-64008?
CVE-2026-64008 can potentially lead to memory corruption and unexpected behavior in the Linux kernel.