Riskcovery

CVE-2026-23305

accel/rocket: fix unwinding in error path in rocket_probe

State
Published
Severity
Not scored
Published
Mar 25, 2026
Updated
May 11, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: fix unwinding in error path in rocket_probe

When rocket_core_init() fails (as could be the case with EPROBE_DEFER), we need to properly unwind by decrementing the counter we just incremented and if this is the first core we failed to probe, remove the rocket DRM device with rocket_device_fini() as well. This matches the logic in rocket_remove(). Failing to properly unwind results in out-of-bounds accesses.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0810d5ad88a18f1e6d549853a388ad0316f74e36 to before 7fc4b49474c836cee7d9801abf05e0198fcbfa74Affected
  • 0810d5ad88a18f1e6d549853a388ad0316f74e36 to before eeaf28c8f4defe371a008a5ddefaf18abf534f81Affected
  • 0810d5ad88a18f1e6d549853a388ad0316f74e36 to before 34f4495a7f72895776b81969639f527c99eb12b9Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.17 through 6.18.*Not affected
  • 6.19.7 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.