UBUNTU-CVE-2026-89592: Integer Overflow
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush() rocketjobpush() allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarray(job->inbocount + job->outbocount, sizeof(void ), GFPKERNEL); memcpy(bos, job->inbos, job->inbocount sizeof(void )); memcpy(&bos[job->inbocount], job->outbos, ...); Two bugs exist: 1. Missing NULL check: if kvmallocarray() fails, bos is NULL and the subsequent memcpy() dereferences it, causing a kernel NULL pointer dereference. 2. Integer overflow: inbocount and outbocount are both u32, set directly from userspace-supplied inbohandlecount and outbohandlecount with no prior validation. Their sum is computed in u32 arithmetic and can wrap to a smaller value, causing the allocation count passed to kvmallocarray() to be smaller than intended. Subsequent uses still operate on the original counts when copying and locking objects, which may lead to out-of-bounds accesses on the temporary array. Fix by using checkaddoverflow() to detect count overflow before the allocation, and adding a NULL check on the allocation result.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In rocket_job_push(), use check_add_overflow() to detect overflow when summing the userspace-supplied in_bo_count and out_bo_count before calling kvmalloc_array().
- Compensating control
In rocket_job_push(), check whether kvmalloc_array() returned NULL before performing memcpy() or otherwise using the allocated bos array.