PT-2026-27670 · Linux · Linux

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-23305

Mitre

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: fix unwinding in error path in rocket probe

When rocket core init() fails (as could be the case with EPROBE DEFER), we need to properly unwind by decrementing the counter we just incremented and if this is the first core we failed to probe, remove the rocket DRM device with rocket device fini() as well. This matches the logic in rocket remove(). Failing to properly unwind results in out-of-bounds accesses.

Related Identifiers

CVE-2026-23305

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-23305 · Security Note
• https://git.kernel.org/stable/c/eeaf28c8f4defe371a008a5ddefaf18abf534f81 · Note
• https://git.kernel.org/stable/c/34f4495a7f72895776b81969639f527c99eb12b9 · Note
• https://git.kernel.org/stable/c/7fc4b49474c836cee7d9801abf05e0198fcbfa74 · Note