CVE-2026-64008 Details
Description
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end]
A use-after-free vulnerability has been identified in the Linux kernel's acceleration component for the Rocket graphics driver. This issue arises in the 'create_bo' ioctl function, where a Graphics Execution Manager (GEM) handle is inserted into the file's IDR (Index Descriptor Register) via 'drm_gem_handle_create()' before completing several critical operations that could fail. If any of these operations, such as scatter-gather table allocation or IOMMU mapping, fail after the handle has been activated, the error handling routine frees the associated object without removing the handle from the IDR. This oversight creates a dangling handle that points to deallocated memory, leading to a use-after-free condition. Subsequent ioctls that use this handle can dereference the freed memory, causing potential exploitation.
The vulnerability has been addressed by modifying the 'rocket_ioctl_create_bo' function to move the GEM handle creation process to after all potentially failing operations have successfully completed. This adjustment aligns with the handling patterns used by other drivers such as Panfrost, Lima, and Etnaviv.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |