---
id: CVE-2026-89592
title: 'accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

  rocket_job_push() allocates a temporary array to hold all input and
  output GEM object poin…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0810d5ad88a18f1e6d549853a388ad0316f74e36 <
    c1a5bf1b6e1d5944183dcef3844a18c17219af4d
  - >-
    Linux >= 0810d5ad88a18f1e6d549853a388ad0316f74e36 <
    dfff90a6eb2258e3b867994ae17af4a7ba3504d2
  - >-
    Linux >= 0810d5ad88a18f1e6d549853a388ad0316f74e36 <
    a85402bff218f2b8f0d806e46c16c2f3d49cdda7
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:24.772Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89592'
references:
  - url: 'https://git.kernel.org/stable/c/c1a5bf1b6e1d5944183dcef3844a18c17219af4d'
  - url: 'https://git.kernel.org/stable/c/dfff90a6eb2258e3b867994ae17af4a7ba3504d2'
  - url: 'https://git.kernel.org/stable/c/a85402bff218f2b8f0d806e46c16c2f3d49cdda7'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89592.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89592'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532166'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89592'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89592'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89592.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10654
ingestedAt: '2026-09-14T11:11:19.886Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

rocket_job_push() allocates a temporary array to hold all input and
output GEM object pointers:

    bos = kvmalloc_array(job->in_bo_count + job->out_bo_count,
                         sizeof(void *), GFP_KERNEL);
    memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *));
    memcpy(&bos[job->in_bo_count], job->out_bos, ...);

Two bugs exist:

1. Missing NULL check: if kvmalloc_array() fails, bos is NULL and
   the subsequent memcpy() dereferences it, causing a kernel NULL
   pointer dereference.

2. Integer overflow: in_bo_count and out_bo_count are both u32, set
   directly from userspace-supplied in_bo_handle_count and
   out_bo_handle_count with no prior validation. Their sum is computed
   in u32 arithmetic and can wrap to a smaller value, causing the
   allocation count passed to kvmalloc_array() to be smaller than
   intended. Subsequent uses still operate on the original counts when
   copying and locking objects, which may lead to out-of-bounds accesses
   on the temporary array.

Fix by using check_add_overflow() to detect count overflow before the
allocation, and adding a NULL check on the allocation result.

## Affected

- `Linux >= 0810d5ad88a18f1e6d549853a388ad0316f74e36 < c1a5bf1b6e1d5944183dcef3844a18c17219af4d`
- `Linux >= 0810d5ad88a18f1e6d549853a388ad0316f74e36 < dfff90a6eb2258e3b867994ae17af4a7ba3504d2`
- `Linux >= 0810d5ad88a18f1e6d549853a388ad0316f74e36 < a85402bff218f2b8f0d806e46c16c2f3d49cdda7`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89592.json)