CVE-2026-23305

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (as could be the case with EPROBE_DEFER), we need to properly unwind by decrementing the counter we just incremented and if this is the first core we failed to probe, remove the rocket DRM device with rocket_device_fini() as well. This matches the logic in rocket_remove(). Failing to properly unwind results in out-of-bounds accesses.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/34f4495a7f72895776b81969639f527c99eb12b9	Patch
https://git.kernel.org/stable/c/7fc4b49474c836cee7d9801abf05e0198fcbfa74	Patch
https://git.kernel.org/stable/c/eeaf28c8f4defe371a008a5ddefaf18abf534f81	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-03-25 11:16

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23305

Mitre link : CVE-2026-23305

CVE.ORG link : CVE-2026-23305

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-23305", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "lessThan": "7fc4b49474c836cee7d9801abf05e0198fcbfa74", "versionType": "git"}, {"status": "affected", "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "lessThan": "eeaf28c8f4defe371a008a5ddefaf18abf534f81", "versionType": "git"}, {"status": "affected", "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "lessThan": "34f4495a7f72895776b81969639f527c99eb12b9", "versionType": "git"}], "programFiles": ["drivers/accel/rocket/rocket_drv.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/accel/rocket/rocket_drv.c"], "defaultStatus": "affected"}]}], "published": "2026-03-25T11:16:26.347", "references": [{"url": "https://git.kernel.org/stable/c/34f4495a7f72895776b81969639f527c99eb12b9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7fc4b49474c836cee7d9801abf05e0198fcbfa74", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eeaf28c8f4defe371a008a5ddefaf18abf534f81", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: fix unwinding in error path in rocket_probe\n\nWhen rocket_core_init() fails (as could be the case with EPROBE_DEFER),\nwe need to properly unwind by decrementing the counter we just\nincremented and if this is the first core we failed to probe, remove the\nrocket DRM device with rocket_device_fini() as well. This matches the\nlogic in rocket_remove(). Failing to properly unwind results in\nout-of-bounds accesses."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naccel/rocket: corregir el desenrollado en la ruta de error en rocket_probe\n\nCuando rocket_core_init() falla (como podr\u00eda ser el caso con EPROBE_DEFER), necesitamos desenrollar correctamente decrementando el contador que acabamos de incrementar y, si este es el primer n\u00facleo que no pudimos sondear, eliminar tambi\u00e9n el dispositivo DRM de rocket con rocket_device_fini(). Esto coincide con la l\u00f3gica en rocket_remove(). No desenrollar correctamente resulta en accesos fuera de l\u00edmites."}], "lastModified": "2026-06-17T10:21:17.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91D34097-62D4-400A-8894-1A45A5B44EEA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}