PT-2026-61325 · Linux · Linux Kernel

CVE-2026-64008 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the rocket ioctl create bo() function. The function inserts a GEM handle into the file's IDR using drm gem handle create() before completing several operations that may fail, such as sgt allocation, drm mm insert, or iommu map. If a failure occurs after the handle is active, the error path calls drm gem shmem object free(), which frees the object without removing the handle from the IDR. This results in a dangling handle pointing to freed slab memory. Subsequent ioctl calls using this handle, such as PREP BO, FINI BO, or SUBMIT, trigger drm gem object lookup() and dereference the freed memory. Additionally, the drm mm insert node generic() function had a bug where its return value was overwritten by iommu map sgtable() without an error check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-64008

Affected Products

Linux Kernel

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64008 · Security Note
• https://twitter.com/CVEnew/status/2078861425628315971 · Twitter Post
• https://git.kernel.org/stable/c/f706e6a4ce75585af979aec3dcbdce68bc76306b · Note
• https://git.kernel.org/stable/c/18abd88d19ea195e2e1547fca0970c2f91d77a42 · Note
• https://git.kernel.org/stable/c/451f1ccbbdb7b65021646704b15902655f8d228a · Note