In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix UAF via dangling GEM handle in create_bo
rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via
drm_gem_handle_create() early on, then performs several operations that
can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after
the handle is live, the error path calls drm_gem_shmem_object_free()
which kfree's the object without removing the handle from the IDR.
This leaves a dangling handle pointing to freed slab memory. Any
subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls
drm_gem_object_lookup() and dereferences freed memory (UAF).
Fix by moving drm_gem_handle_create() to after all fallible operations
succeed, matching the pattern used by panfrost, lima, and etnaviv.
Also fix drm_mm_insert_node_generic() whose return value was silently
overwritten by iommu_map_sgtable() on the next line. Add the missing
error check.
[tomeu: Move handle creation to the very end]
References
Configurations
Configuration 1 (hide)
|
History
02 Oct 2026, 19:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/18abd88d19ea195e2e1547fca0970c2f91d77a42 - Patch | |
| References | () https://git.kernel.org/stable/c/451f1ccbbdb7b65021646704b15902655f8d228a - Patch | |
| References | () https://git.kernel.org/stable/c/f706e6a4ce75585af979aec3dcbdce68bc76306b - Patch | |
| CWE | CWE-416 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-02 19:55
NVD link : CVE-2026-64008
Mitre link : CVE-2026-64008
CVE.ORG link : CVE-2026-64008
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free