CVE-2026-99183

A flaw was found in the Linux kernel's Rocket accelerator driver. When unbinding an accelerator core while workloads are actively executing, the driver fails to properly search all remaining core slots during scheduler lookups, resulting in an unchecked null reference. A privileged local user could exploit this flaw to trigger a null pointer dereference, causing a system crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because triggering the condition requires elevated administrative privileges to unbind accelerator hardware devices, and exploitation is confined to a local denial of service without compromising confidentiality or data integrity. In typical Red Hat Enterprise Linux environments, specialized neural processing unit (NPU) hardware utilizing this driver is rarely deployed. Furthermore, normal administrative workflows do not dynamically detach active execution units while processing workloads, significantly reducing exposure in production systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.