CVE-2026-64008

🗓️ 19 Jul 2026 14:56:23Reported by LinuxType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

Fix UAF from dangling graphics memory handle in create_bo by delaying handle creation until after success.

Reporter	Title	Published	Views	Family All 29
BDU FSTEC	The vulnerability of the rocket_ioctl_create_bo() function in the drivers/accel/rocket/rocket_gem.c module of the Linux kernel’s acceleration device driver allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.	9 Sep 202600:00	–	bdu_fstec
Cvelist	CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo	19 Jul 202614:56	–	cvelist
Debian CVE	CVE-2026-64008	19 Jul 202614:56	–	debiancve
EUVD	EUVD-2026-45581	19 Jul 202614:56	–	euvd
NVD	CVE-2026-64008	19 Jul 202616:17	–	nvd
OSV	BELL-CVE-2026-64008	22 Jul 202606:04	–	osv
OSV	DEBIAN-CVE-2026-64008	19 Jul 202616:17	–	osv
OSV	UBUNTU-CVE-2026-64008	20 Jul 202600:00	–	osv
OSV	USN-8593-1 linux-ibm, linux-oracle vulnerabilities	23 Jul 202607:35	–	osv
OSV	USN-8603-1 linux-azure, linux-azure-fde vulnerabilities	24 Jul 202609:51	–	osv

Vulners

CNA

Node

linux linux_kernelRange6.18–6.18.35

linux linux_kernelRange6.19.0–7.0.12

linux linux_kernelRange7.1.0≥

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/accel/rocket/rocket_gem.c"
    ],
    "versions": [
      {
        "version": "658ebeac33517bd3169d4b65ed801e9065d0211a",
        "lessThan": "18abd88d19ea195e2e1547fca0970c2f91d77a42",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "658ebeac33517bd3169d4b65ed801e9065d0211a",
        "lessThan": "451f1ccbbdb7b65021646704b15902655f8d228a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "658ebeac33517bd3169d4b65ed801e9065d0211a",
        "lessThan": "f706e6a4ce75585af979aec3dcbdce68bc76306b",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/accel/rocket/rocket_gem.c"
    ],
    "versions": [
      {
        "version": "6.18",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "6.18",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.35",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.12",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/451f1ccbbdb7b65021646704b15902655f8d228a
git	www.git.kernel.org/stable/c/18abd88d19ea195e2e1547fca0970c2f91d77a42
git	www.git.kernel.org/stable/c/f706e6a4ce75585af979aec3dcbdce68bc76306b

Parameter	Position	Path	Description
drm_gem_handle_create	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
GEM handle	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
drm_gem_shmem_object_free	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
iommu_map	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
drm_mm_insert_node_generic	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
drm_gem_object_lookup	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
PREP_BO	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
FINI_BO	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.
SUBMIT	request body	rocket_ioctl_create_bo	UAF via dangling GEM handle in create_bo allows use-after-free when handling subsequent ioctls (PREP_BO, FINI_BO, SUBMIT) after a failed operation frees the object but not the handle.

05 Aug 2026 12:38Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.8

EPSS0.00127