CVE-2026-89976

CVE-2026-89976 affects the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU accelerator). In ethosu_ioctl_submit_job(), the done_fence is allocated before buffer handles are validated. On error paths, ethosu_job_err_cleanup() frees the job but leaks the uninitialized fence. Additionally, a sch...

EUVD-2026-80576

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...

CVE-2026-89976 accel/ethosu: fix job completion fence cleanup

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...

PT-2026-93618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ethosu component where the ethosu probe function fails to properly handle errors returned by devm platform ioremap resource. When a register resource cannot ...

Linux Distros Unpatched Vulnerability : CVE-2026-89976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call...

Linux Distros Unpatched Vulnerability : CVE-2026-89977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe...

CVE-2026-89976: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...

PT-2026-93617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ethosu component where ethosu ioctl submit job allocates a done fence before validating buffer handles. If an error occurs after this allocation, ethosu job...

CVE-2026-89977: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

CVE-2026-89978: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: return early from a zero-length flush SYNCBO does not constrain its size, so a request for zero bytes reaches drmclflushvirtrange, which ends with an unconditional clflushoptend - 1. For an empty range that is the...

SUSE CVE-2026-89592

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

SUSE CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

Linux Distros Unpatched Vulnerability : CVE-2026-89592

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object...

Linux Distros Unpatched Vulnerability : CVE-2026-89591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup...

CVE-2026-89591

A flaw was found in the Linux kernel's accel/rocket module. During error handling in the rocketioctlsubmitjob function, a cleanup routine may attempt to free a job-domain pointer that has not yet been initialized, leading to a NULL pointer dereference. A local attacker could exploit this...

CVE-2026-89592

A flaw was found in the accel/rocket component of the Linux kernel. This vulnerability arises from two issues: a missing null check after a memory allocation failure and an integer overflow when calculating memory requirements based on user-supplied values. An attacker could exploit these flaws t...

CVE-2026-89590

A flaw was found in the accel/rocket driver within the Linux kernel. Incorrect error handling in the rocketjobrun function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memory Access DMA fences and Power Management PM resources during error...

CVE-2026-89592

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

DEBIAN-CVE-2026-89592

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix NULL dereference and integer overflow in rocketjobpush rocketjobpush allocates a temporary array to hold all input and output GEM object pointers: bos = kvmallocarrayjob-inbocount + job-outbocount, sizeofvoid ,...

DEBIAN-CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...