CVE-2026-89591: accel/rocket: initialize job domain before cleanup paths
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: initialize job domain before cleanup paths
rocketioctlsubmitjob() releases rjob through rocketjobput() on allocation error paths. rocketjobcleanup() unconditionally calls rocketiommudomainput(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can therefore clean up a job with a NULL domain pointer.
Take the per-file domain reference before the first error path can release rjob. Also clear rjob->tasks after freeing it in rocketcopytasks(), so the common cleanup path cannot free the task array again after a task-copy error.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to reach the vulnerable cleanup path?
A job submission must encounter an allocation error, task-copy error, or buffer-object lookup failure before the job's domain has been assigned. The cleanup path can then release a NULL domain pointer; task-copy failures can also lead to a second free of the task array.
What does the fix change in the error handling path?
It obtains the per-file domain reference before any error path can release the job. It also clears the job's task pointer after freeing tasks during task-copy failure, preventing the common cleanup path from freeing that array again.
Are affected or fixed Linux kernel versions identified?
No affected or fixed kernel version numbers are provided. The advisory supplies three stable kernel commit references for tracking the resolved change.