{"id":"CVE-2026-89591","summary":"accel/rocket: initialize job domain before cleanup paths","details":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: initialize job domain before cleanup paths\n\nrocket_ioctl_submit_job() releases rjob through rocket_job_put() on\nallocation error paths. rocket_job_cleanup() unconditionally calls\nrocket_iommu_domain_put(job-\u003edomain), but job-\u003edomain is assigned only\nafter task copying and BO lookups. A failure before that assignment can\ntherefore clean up a job with a NULL domain pointer.\n\nTake the per-file domain reference before the first error path can release\nrjob. Also clear rjob-\u003etasks after freeing it in rocket_copy_tasks(), so\nthe common cleanup path cannot free the task array again after a task-copy\nerror.","modified":"2026-09-13T03:47:19.731613829Z","published":"2026-09-11T19:44:55.080Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89591.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3043230296653a609ab50006899e64bbb2d99465"},{"type":"WEB","url":"https://git.kernel.org/stable/c/70e6a33d68a9b03335c5426332666e52d07f45d6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/81731f1eda5e6a1dfad31445f741de9bbefbb08e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89591.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89591"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0810d5ad88a18f1e6d549853a388ad0316f74e36"},{"fixed":"3043230296653a609ab50006899e64bbb2d99465"},{"fixed":"81731f1eda5e6a1dfad31445f741de9bbefbb08e"},{"fixed":"70e6a33d68a9b03335c5426332666e52d07f45d6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89591.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.18.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89591.json"}}],"schema_version":"1.9.0"}