CVE-2026-89592

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

rocket_job_push() allocates a temporary array to hold all input and

output GEM object pointers:

bos = kvmalloc_array(job->in_bo_count + job->out_bo_count,

sizeof(void *), GFP_KERNEL);

memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *));

memcpy(&bos[job->in_bo_count], job->out_bos, ...);

Two bugs exist:

1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and

the subsequent memcpy() dereferences it, causing a kernel NULL

pointer dereference.

2. Integer overflow: in_bo_count and out_bo_count are both u32, set

directly from userspace-supplied in_bo_handle_count and

out_bo_handle_count with no prior validation. Their sum is computed

in u32 arithmetic and can wrap to a smaller value, causing the

allocation count passed to kvmalloc_array() to be smaller than

intended. S

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References