{"id":"CVE-2026-89976","title":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ethosu: fix job completion fence cleanup\n\nethosu_ioctl_submit_job() allocates done_fence before validating buffer\nhandles","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ethosu: fix job completion fence cleanup\n\nethosu_ioctl_submit_job() allocates done_fence before validating buffer\nhandles. Errors after allocation call ethosu_job…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b < b3e0f79af1f27339d8d2527c02cc3e8397c2f69f","Linux >= 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b < 2d2a3adc91950f9a18829dadc7317fb5180a15c5","Linux 6.19"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:17:08.450","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89976","references":[{"url":"https://git.kernel.org/stable/c/2d2a3adc91950f9a18829dadc7317fb5180a15c5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3e0f79af1f27339d8d2527c02cc3e8397c2f69f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.954Z","epss":0.00189,"epssPercentile":0.08795,"slug":"CVE-2026-89976","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/ethosu: fix job completion fence cleanup\n\nethosu_ioctl_submit_job() allocates done_fence before validating buffer\nhandles. Errors after allocation call ethosu_job_err_cleanup(), which frees\nthe job but leaks the uninitialized fence.\n\nA scheduler dependency error also lets ethosu_job_run() return before\ndma_fence_init(). Normal cleanup then passes a zeroed refcount to\ndma_fence_put().\n\nRelease done_fence in the common cleanup path and use\ndma_fence_was_initialized() to distinguish initialized fences from raw\nallocations.\n\n[robh: also fix goto]\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}