CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo
A use-after-free vulnerability in the Linux kernel's Rocket accelerator driver allows local attackers to execute arbitrary code or escalate privileges via dangling GEM handles.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64008?
CVE-2026-64008 is a high-severity use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: fix UAF via dangling GEM handle in create_bo
rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR.
This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF).
Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv.
Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check.
[tomeu: Move handle creation to the very end]
Weakness: CWE-416
Which versions are affected by CVE-2026-64008?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64008?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64008 being exploited?
There is no known exploitation of CVE-2026-64008 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64008, DEBIAN-CVE-2026-64008, GHSA-3328-p844-pfhq, UBUNTU-CVE-2026-64008.