CVE-2026-89590

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89590", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.730Z", "datePublished": "2026-09-11T19:44:54.328Z", "dateUpdated": "2026-10-19T08:49:22.866Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:49:22.866Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: Fix error path handling in rocket_job_run()\n\nIn rocket_job_run(), after taking an extra fence reference for\njob->done_fence via dma_fence_get(), the error paths have three bugs:\n\n- The dma_fence reference held by job->done_fence is never released,\n causing a reference leak.\n- pm_runtime_get_sync() increments the usage counter even on failure,\n but the error path does not decrement it, leaking the runtime PM\n reference and preventing the NPU from suspending.\n- A valid but unsignaled fence is returned to the DRM scheduler,\n which triggers WARN(\"Fence ... released with pending signals!\")\n when the scheduler drops its reference.\n\nFix by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get()\nwhich auto-balances the usage counter on failure, releasing both fence\nreferences on error, and returning ERR_PTR(ret) instead of the\nunsignaled fence.\n\n[tomeu: Refactored error paths to use consolidated goto labels]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/rocket/rocket_job.c"], "versions": [{"version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "lessThan": "9ad8821573a36bcd18c84dbca3027802b0ea062f", "status": "affected", "versionType": "git"}, {"version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "lessThan": "7d6fa298c23495b805004f5f446497b661998fa5", "status": "affected", "versionType": "git"}, {"version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "lessThan": "9b2dedadf6a91ac3fc9fae268bb556a041222711", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/rocket/rocket_job.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9ad8821573a36bcd18c84dbca3027802b0ea062f"}, {"url": "https://git.kernel.org/stable/c/7d6fa298c23495b805004f5f446497b661998fa5"}, {"url": "https://git.kernel.org/stable/c/9b2dedadf6a91ac3fc9fae268bb556a041222711"}], "title": "accel/rocket: Fix error path handling in rocket_job_run()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/rocket/rocket_job.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9ad8821573a36bcd18c84dbca3027802b0ea062f", "status": "affected", "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "versionType": "git"}, {"lessThan": "7d6fa298c23495b805004f5f446497b661998fa5", "status": "affected", "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "versionType": "git"}, {"lessThan": "9b2dedadf6a91ac3fc9fae268bb556a041222711", "status": "affected", "version": "0810d5ad88a18f1e6d549853a388ad0316f74e36", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/accel/rocket/rocket_job.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: Fix error path handling in rocket_job_run()\n\nIn rocket_job_run(), after taking an extra fence reference for\njob->done_fence via dma_fence_get(), the error paths have three bugs:\n\n- The dma_fence reference held by job->done_fence is never released,\n causing a reference leak.\n- pm_runtime_get_sync() increments the usage counter even on failure,\n but the error path does not decrement it, leaking the runtime PM\n reference and preventing the NPU from suspending.\n- A valid but unsignaled fence is returned to the DRM scheduler,\n which triggers WARN(\"Fence ... released with pending signals!\")\n when the scheduler drops its reference.\n\nFix by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get()\nwhich auto-balances the usage counter on failure, releasing both fence\nreferences on error, and returning ERR_PTR(ret) instead of the\nunsignaled fence.\n\n[tomeu: Refactored error paths to use consolidated goto labels]"}], "id": "CVE-2026-89590", "lastModified": "2026-10-19T09:17:55.317", "metrics": {}, "published": "2026-09-11T20:19:43.567", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d6fa298c23495b805004f5f446497b661998fa5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ad8821573a36bcd18c84dbca3027802b0ea062f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b2dedadf6a91ac3fc9fae268bb556a041222711"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel (accel/rocket): Resource leaks due to improper error handling", "id": "2532024", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532024"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the `accel/rocket` driver within the Linux kernel. Incorrect error handling in the `rocket_job_run()` function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memory Access (DMA) fences and Power Management (PM) resources during error conditions. The consequence is that the Neural Processing Unit (NPU) may be prevented from suspending, leading to resource exhaustion and potential system instability."], "name": "CVE-2026-89590", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:44:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89590\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89590\nhttps://git.kernel.org/stable/c/7d6fa298c23495b805004f5f446497b661998fa5\nhttps://git.kernel.org/stable/c/9ad8821573a36bcd18c84dbca3027802b0ea062f\nhttps://git.kernel.org/stable/c/9b2dedadf6a91ac3fc9fae268bb556a041222711"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0810d5ad88a18f1e6d549853a388ad0316f74e36,9ad8821573a36bcd18c84dbca3027802b0ea062f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0810d5ad88a18f1e6d549853a388ad0316f74e36,7d6fa298c23495b805004f5f446497b661998fa5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0810d5ad88a18f1e6d549853a388ad0316f74e36,9b2dedadf6a91ac3fc9fae268bb556a041222711)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T07:45:10.712522+00:00", "updated": "2026-09-15T22:00:17.589958+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}