---
id: CVE-2026-99184
title: 'accel/rocket: search every core slot when a core is removed'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/rocket: search every core slot when a core is removed

  rocket_remove() decrements rdev->num_cores for each core it removes,
  while find_core_for_dev() searches slo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ed98261b41687323ffa02ca20fef1e60b38fd1aa <
    5078c91f5c84bb383d0a10ed39856f98575e39cf
  - >-
    Linux >= ed98261b41687323ffa02ca20fef1e60b38fd1aa <
    134451cf95cb6aa04b725fbfa04e878d072756f5
  - >-
    Linux >= ed98261b41687323ffa02ca20fef1e60b38fd1aa <
    6eff1d69dae808a1518aee5a58d0853a8db3f1be
  - Linux 6.18
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:42.469Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99184'
references:
  - url: 'https://git.kernel.org/stable/c/5078c91f5c84bb383d0a10ed39856f98575e39cf'
  - url: 'https://git.kernel.org/stable/c/134451cf95cb6aa04b725fbfa04e878d072756f5'
  - url: 'https://git.kernel.org/stable/c/6eff1d69dae808a1518aee5a58d0853a8db3f1be'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.378Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: search every core slot when a core is removed

rocket_remove() decrements rdev->num_cores for each core it removes,
while find_core_for_dev() searches slots 0 to num_cores - 1. Unbinding
the cores in the order they were bound therefore loses the last one: by
the time it is removed the search range has already shrunk past its
slot, so find_core_for_dev() returns -1 and rocket_remove() gives up
without doing anything.

num_cores never reaches zero, rocket_device_fini() never runs, and the
file-scoped rdev keeps pointing at a device that is going away. Binding
the cores again starts from that stale count, because rocket_probe()
takes rdev->num_cores as the slot to fill. On an RK3588, which describes
three cores, the second round lands on slots 1, 2 and 3 while rdev->cores
was allocated with room for three:

  rocket fdab0000.npu: Rockchip NPU core 1 version: 1179210309
  rocket fdac0000.npu: Rockchip NPU core 2 version: 1179210309
  rocket fdad0000.npu: Rockchip NPU core 3 version: 1179210309

The write to rdev->cores[3] is past the end of the array.

Nothing in tree reads the core array often enough to notice, so the
overrun is silent today. It turned up while testing a devfreq series on
top of this, where a worker walks every core a few times a second, and
UBSAN caught the first bool it read out of the overrun entry:

  UBSAN: invalid-load in drivers/accel/rocket/rocket_devfreq.c:47:10
  load of value 5 is not a valid value for type '_Bool'
  Workqueue: devfreq_wq devfreq_monitor

Record how many slots were allocated and search all of them. Every core
is then found on removal, num_cores reaches zero, the device is torn down
and a later bind starts from a clean rdev.

This does not make unbinding a single core out of several work. probe
still takes num_cores as the slot to fill, so rebinding one core while
its siblings stay bound would write over a slot that is already in use,
and rocket_open() still reaches for cores[0] whether or not anything is
there. Both of those want more thought than a fix should carry.

Found by unbinding and rebinding all three cores on an Orange Pi 5 Plus.
With this applied, 25 unbind/rebind rounds and 5 module unload/reload
rounds run clean there: the cores land in slots 0, 1 and 2 every time,
whichever order they are bound in, and the shared supply goes back to a
single user after each round.

## Affected

- `Linux >= ed98261b41687323ffa02ca20fef1e60b38fd1aa < 5078c91f5c84bb383d0a10ed39856f98575e39cf`
- `Linux >= ed98261b41687323ffa02ca20fef1e60b38fd1aa < 134451cf95cb6aa04b725fbfa04e878d072756f5`
- `Linux >= ed98261b41687323ffa02ca20fef1e60b38fd1aa < 6eff1d69dae808a1518aee5a58d0853a8db3f1be`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.