CVE-2026-89592: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix NULL dereference and integer overflow in rocketjobpush()
rocketjobpush() allocates a temporary array to hold all input and output GEM object pointers:
bos = kvmallocarray(job->inbocount + job->outbocount, sizeof(void ), GFPKERNEL); memcpy(bos, job->inbos, job->inbocount sizeof(void )); memcpy(&bos[job->inbocount], job->outbos, ...);
Two bugs exist:
1. Missing NULL check: if kvmallocarray() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference.
2. Integer overflow: inbocount and outbocount are both u32, set directly from userspace-supplied inbohandlecount and outbohandlecount with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmallocarray() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array.
Fix by using checkaddoverflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In accel/rocket's rocket_job_push(), use check_add_overflow() to detect overflow in the sum of in_bo_count and out_bo_count before calling kvmalloc_array(), and check whether the allocation result is NULL before using it in memcpy().
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed where userspace can supply input and output BO handle counts to rocket_job_push(). Those counts are assigned directly to u32 fields without prior validation in the affected implementation.
What does an attacker need to trigger the vulnerable paths?
An attacker needs the ability to submit values for both input and output BO handle counts through the userspace-facing job submission path. Large counts can make their u32 sum wrap, while memory-allocation failure can trigger the NULL-dereference path.
How can I determine whether the fix is present?
Inspect rocket_job_push() for overflow validation of the combined input and output BO counts using check_add_overflow() before allocation, and for a NULL check after kvmalloc_array(). The corrected code must avoid copying or locking objects when allocation fails or the count addition overflows.