Answer in brief
CVE-2026-89590 records a Unknown severity vulnerability in accel/rocket: Fix error path handling in rocket_job_run(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0810d5ad88a18f1e6d549853a388ad0316f74e36 <9ad8821573a36bcd18c84dbca3027802b0ea062f || >=0810d5ad88a18f1e6d549853a388ad0316f74e36 <7d6fa298c23495b805004f5f446497b661998fa5 || >=0810d5ad88a18f1e6d549853a388ad0316f74e36 <9b2dedadf6a91ac3fc9fae268bb556a041222711 | 9ad8821573a36bcd18c84dbca3027802b0ea062f, 7d6fa298c23495b805004f5f446497b661998fa5, 9b2dedadf6a91ac3fc9fae268bb556a041222711 |
| Linux/Linuxgeneric | 6.18 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocket_job_run() In rocket_job_run(), after taking an extra fence reference for job->done_fence via dma_fence_get(), the error paths have three bugs: - The dma_fence reference held by job->done_fence is never released, causing a reference leak. - pm_runtime_get_sync() increments the usage counter even on failure, but the error path does not decrement it, leaking the runtime PM reference and preventing the NPU from suspending. - A valid but unsignaled fence is returned to the DRM scheduler, which triggers WARN("Fence ... released with pending signals!") when the scheduler drops its reference. Fix by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get() which auto-balances the usage counter on failure, releasing both fence references on error, and returning ERR_PTR(ret) instead of the unsignaled fence. [tomeu: Refactored error paths to use consolidated goto labels]
Quoted source text, attributed separately from HOL analysis.