CVE-2026-89591: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89591 Overview

CVE-2026-89591 is a Linux kernel vulnerability in the accel/rocket driver, which supports the Rockchip NPU (Neural Processing Unit) accelerator. The flaw resides in rocket_ioctl_submit_job(), where the job cleanup path can dereference an uninitialized job->domain pointer. When an allocation or task-copy failure occurs before job->domain is assigned, rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain) on a NULL pointer. The upstream fix takes the per-file domain reference before the first error path and clears rjob->tasks after freeing it in rocket_copy_tasks() to prevent a double-free of the task array.

Critical Impact
A local user issuing crafted ioctls to the rocket accelerator device can trigger a NULL pointer dereference in kernel context, resulting in a kernel oops and denial of service on affected systems.

Affected Products

Linux kernel versions containing the accel/rocket driver prior to the fix commits
Distributions shipping mainline kernels with Rockchip NPU (accel/rocket) support enabled
Stable kernel branches pending backport of commits 3043230, 70e6a33, and 81731f1

Discovery Timeline

2026-09-11 - CVE-2026-89591 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89591

Vulnerability Analysis

The accel/rocket driver exposes an ioctl interface allowing user space to submit compute jobs to the Rockchip NPU. Job submission is handled by rocket_ioctl_submit_job(), which allocates an rjob structure, copies task descriptors from user space, resolves buffer object (BO) references, and assigns the IOMMU domain associated with the file handle.

The defect is an ordering flaw. If allocation or BO lookup fails before job->domain is populated, the error path invokes rocket_job_put(), which in turn calls rocket_job_cleanup(). Cleanup then unconditionally calls rocket_iommu_domain_put(job->domain) on a zero-initialized pointer, dereferencing NULL in kernel mode.

A secondary issue exists in rocket_copy_tasks(). On a task-copy error, the freed task array is not cleared from rjob->tasks, allowing the common cleanup path to free it again and produce a double-free condition.

Root Cause

The root cause is uninitialized state used during exception handling. The job structure's domain field is assigned late in the submission flow, but the cleanup helper assumes it is always valid. Combined with a stale tasks pointer after kfree(), this creates a classic NULL Pointer Dereference and Use After Free window along cleanup paths.

Attack Vector

Exploitation requires local access to the /dev/accel/accel* device node exposed by the accel/rocket driver. An attacker with permission to open the device can invoke DRM_IOCTL_ROCKET_SUBMIT with parameters engineered to fail during task copy or BO resolution. The resulting NULL dereference crashes the kernel, causing denial of service. Systems where the device node is world-accessible increase the exposure surface.

No verified public exploit code is available. See the upstream fix commits for the exact patch semantics: Kernel commit 3043230, Kernel commit 70e6a33, and Kernel commit 81731f1.

Detection Methods for CVE-2026-89591

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing rocket_job_cleanup, rocket_iommu_domain_put, or rocket_ioctl_submit_job with a NULL dereference at a low virtual address.
Repeated process crashes or system instability correlated with user processes opening /dev/accel/accel* device nodes.
Unexpected kernel BUG: messages tagged with the accel/rocket module during job submission.

Detection Strategies

Monitor kernel ring buffer output for stack traces that include rocket_job_put or rocket_iommu_domain_put frames.
Audit which local users and services hold read/write access to /dev/accel/accel* device nodes on Rockchip NPU hardware.
Correlate SIGSEGV or SIGBUS process exits with kernel taint flags recorded after a rocket driver fault.

Monitoring Recommendations

Ship kernel logs to a centralized log platform and alert on kernel oops signatures from accelerator drivers.
Track loaded kernel modules (lsmod | grep rocket) across the fleet and flag hosts running vulnerable builds.
Baseline expected callers of the rocket ioctl interface and alert on unexpected processes issuing accelerator submissions.

How to Mitigate CVE-2026-89591

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 3043230, 70e6a33, and 81731f1 to the accel/rocket driver.
Restrict access to /dev/accel/accel* device nodes to trusted users and services using group ownership and file permissions.
Unload the rocket module (modprobe -r rocket) on systems that do not require Rockchip NPU acceleration until a patched kernel is deployed.

Patch Information

The fix initializes the per-file IOMMU domain reference before any error path can release rjob, ensuring rocket_job_cleanup() always operates on a valid domain pointer. It also clears rjob->tasks after kfree() inside rocket_copy_tasks() to eliminate the double-free window. Distribution maintainers should backport the three referenced commits to any kernel branch shipping the accel/rocket driver.

Workarounds

Disable the Rockchip NPU driver at boot by blacklisting the rocket module where the accelerator is not in use.
Tighten udev rules so that only authorized service accounts can open the accelerator device node.
Deploy mandatory access control policies (SELinux, AppArmor) that constrain which processes may invoke DRM ioctls on /dev/accel/*.

bash

# Restrict access to the Rockchip NPU device node
sudo groupadd -r npu
sudo chown root:npu /dev/accel/accel0
sudo chmod 0660 /dev/accel/accel0

# Optionally blacklist the driver until a patched kernel is installed
echo "blacklist rocket" | sudo tee /etc/modprobe.d/blacklist-rocket.conf
sudo modprobe -r rocket