CVE-2026-89592: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix NULL dereference and integer overflow in rocketjobpush()
rocketjobpush() allocates a temporary array to hold all input and output GEM object pointers:
bos = kvmallocarray(job->inbocount + job->outbocount, sizeof(void ), GFPKERNEL); memcpy(bos, job->inbos, job->inbocount sizeof(void )); memcpy(&bos[job->inbocount], job->outbos, ...);
Two bugs exist:
1. Missing NULL check: if kvmallocarray() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference.
2. Integer overflow: inbocount and outbocount are both u32, set directly from userspace-supplied inbohandlecount and outbohandlecount with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmallocarray() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array.
Fix by using checkaddoverflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In accel/rocket (rocket_job_push()), detect u32 addition overflow for job->in_bo_count + job->out_bo_count using check_add_overflow() before computing the allocation size/count used by kvmalloc_array() and before subsequent memcpy/copy operations.
Linux kernel (kvm/accel/rocket) Use check_add_overflow() for in_bo_count/out_bo_count addition = Use check_add_overflow() to detect count overflow before allocating/copying based on job->in_bo_count + job->out_bo_count - Configuration
In accel/rocket (rocket_job_push()), after calling kvmalloc_array(job->in_bo_count + job->out_bo_count, sizeof(void *), GFP_KERNEL), verify bos is not NULL and handle the failure path so subsequent uses (including memcpy(&bos[job->in_bo_count], ...) and memcpy(bos, ...)) do not dereference a NULL pointer.
Linux kernel (kvm/accel/rocket) NULL check after kvmalloc_array() = Add a NULL check on bos after kvmalloc_array()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed where userspace can supply input and output BO handle counts to rocket_job_push(). Those counts are assigned directly to u32 fields without prior validation in the affected implementation.
What does an attacker need to trigger the vulnerable paths?
An attacker needs the ability to submit values for both input and output BO handle counts through the userspace-facing job submission path. Large counts can make their u32 sum wrap, while memory-allocation failure can trigger the NULL-dereference path.
How can I determine whether the fix is present?
Inspect rocket_job_push() for overflow validation of the combined input and output BO counts using check_add_overflow() before allocation, and for a NULL check after kvmalloc_array(). The corrected code must avoid copying or locking objects when allocation fails or the count addition overflows.