{"id":"CVE-2026-64008","title":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: fix UAF via dangling GEM handle in create_bo\n\nrocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via\ndrm_gem_handle_create() early on, then…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: fix UAF via dangling GEM handle in create_bo\n\nrocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via\ndrm_gem_handle_create() early on, then…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.18, < 6.18.35","linux_kernel >= 6.19, < 7.0.12","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.12"],"published":"2026-07-19","updated":"2026-10-02","sourceUpdated":"2026-10-02T19:55:18.030","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64008","references":[{"url":"https://git.kernel.org/stable/c/18abd88d19ea195e2e1547fca0970c2f91d77a42","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/451f1ccbbdb7b65021646704b15902655f8d228a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f706e6a4ce75585af979aec3dcbdce68bc76306b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00173,"epssPercentile":0.06086,"ingestedAt":"2026-10-02T22:33:09.810Z","slug":"CVE-2026-64008","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: fix UAF via dangling GEM handle in create_bo\n\nrocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via\ndrm_gem_handle_create() early on, then performs several operations that\ncan fail (sgt allocation, drm_mm insert, iommu_map). If any fail after\nthe handle is live, the error path calls drm_gem_shmem_object_free()\nwhich kfree's the object without removing the handle from the IDR.\n\nThis leaves a dangling handle pointing to freed slab memory. Any\nsubsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls\ndrm_gem_object_lookup() and dereferences freed memory (UAF).\n\nFix by moving drm_gem_handle_create() to after all fallible operations\nsucceed, matching the pattern used by panfrost, lima, and etnaviv.\n\nAlso fix drm_mm_insert_node_generic() whose return value was silently\noverwritten by iommu_map_sgtable() on the next line. Add the missing\nerror check.\n\n[tomeu: Move handle creation to the very end]\n\n## Affected\n\n- `linux_kernel >= 6.18, < 6.18.35`\n- `linux_kernel >= 6.19, < 7.0.12`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.12`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}