CVE-2026-64008

A flaw was found in the accel/rocket component of the Linux kernel. This vulnerability, a Use-After-Free (UAF), occurs in the rocket_ioctl_create_bo() function. A local attacker could exploit this by triggering a failure in subsequent operations after a Graphics Execution Manager (GEM) handle is created, leading to a dangling pointer to freed memory. This allows the attacker to dereference freed memory, which can result in system instability or potentially lead to privilege escalation.

This Important-severity use-after-free flaw in the Linux kernel accel/rocket driver does not affect Red Hat Enterprise Linux or Red Hat In-Vehicle OS, because the vulnerable code is not present in the shipped kernel packages. The flaw is in rocket_ioctl_create_bo(), which inserts a Graphics Execution Manager (GEM) handle into the file's IDR via drm_gem_handle_create() before several fallible operations (scatter-gather table allocation, drm_mm node insertion, and IOMMU mapping) have completed. If any of those operations fail, the error path frees the GEM object without removing the handle from the IDR, leaving a dangling handle that points to freed slab memory. A local attacker with access to the rocket DRM accelerator device could then issue a subsequent ioctl (PREP_BO, FINI_BO, or SUBMIT) using the dangling handle, causing drm_gem_object_lookup() to return and dereference the freed memory. This could result in a kernel use-after-free that crashes the system (kernel panic) or potentially leads to privilege escalation. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which is lower than the upstream CVE record score of 7.8, because successful exploitation requires a local attacker to reliably trigger specific allocation failures in the buffer-object creation path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.