CVE-2026-64008

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: fix UAF via dangling GEM handle in create_bo

rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via

drm_gem_handle_create() early on, then performs several operations that

can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after

the handle is live, the error path calls drm_gem_shmem_object_free()

which kfree's the object without removing the handle from the IDR.

This leaves a dangling handle pointing to freed slab memory. Any

subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls

drm_gem_object_lookup() and dereferences freed memory (UAF).

Fix by moving drm_gem_handle_create() to after all fallible operations

succeed, matching the pattern used by panfrost, lima, and etnaviv.

Also fix drm_mm_insert_node_generic() whose return value was silently

overwritten by iommu_map_sgtable() on the next line. Add the missing

error check.

[tomeu: Move handle creation to th

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References