CVE-2026-89591: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket_ioctl_submit_job() releases rjob through rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can therefore clean up a job with a NULL domain pointer. Take the per-file domain reference before the first error path can release rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so the common cleanup path cannot free the task array again after a task-copy error.

Засегнати продукти

• Linux Linux: 0810d5ad88a18f1e6d549853a388ad0316f74e36 преди 3043230296653a609ab50006899e64bbb2d99465; 0810d5ad88a18f1e6d549853a388ad0316f74e36 преди 81731f1eda5e6a1dfad31445f741de9bbefbb08e; 0810d5ad88a18f1e6d549853a388ad0316f74e36 преди 70e6a33d68a9b03335c5426332666e52d07f45d6
• Linux Linux: 6.18; преди 6.18; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-89591
• https://nvd.nist.gov/vuln/detail/CVE-2026-89591
• https://git.kernel.org/stable/c/3043230296653a609ab50006899e64bbb2d99465
• https://git.kernel.org/stable/c/81731f1eda5e6a1dfad31445f741de9bbefbb08e
• https://git.kernel.org/stable/c/70e6a33d68a9b03335c5426332666e52d07f45d6