CVE-2026-89590

A flaw was found in the accel/rocket driver within the Linux kernel. Incorrect error handling in the rocket_job_run() function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memory Access (DMA) fences and Power Management (PM) resources during error conditions. The consequence is that the Neural Processing Unit (NPU) may be prevented from suspending, leading to resource exhaustion and potential system instability.

A moderate severity flaw was found in the Linux kernel accel/rocket driver, which drives certain neural processing unit (NPU) hardware. The rocket_job_run() function handles error paths incorrectly: when a job cannot be run, the extra DMA fence reference taken for job->done_fence is never released, the runtime power-management usage counter incremented by pm_runtime_get_sync() is not balanced on failure, and a valid but unsignaled fence is returned to the DRM scheduler, which later triggers a kernel WARN when the scheduler drops its reference. A local user with access to the rocket NPU device could repeatedly trigger these error paths, leaking kernel references and preventing the NPU from suspending, ultimately causing resource exhaustion and system instability. The impact is limited to availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I/N/A:H, Red Hat severity moderate). The accel/rocket driver is not present in the kernel versions shipped in Red Hat Enterprise Linux or in the Red Hat Enterprise Linux CoreOS kernels used by OpenShift Container Platform, so all currently tracked Red Hat products are not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.