# CVE-2026-89591

## Summary

- **CVE ID:** CVE-2026-89591
- **Severity:** UNKNOWN
- **CVSS Score:** 0
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 16, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: initialize job domain before cleanup paths

rocket_ioctl_submit_job() releases rjob through rocket_job_put() on
allocation error paths. rocket_job_cleanup() unconditionally calls
rocket_iommu_domain_put(job->domain), but job->domain is assigned only
after task copying and BO lookups. A failure before that assignment can
therefore clean up a job with a NULL domain pointer.

Take the per-file domain reference before the first error path can release
rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so
the common cleanup path cannot free the task array again after a task-copy
error.

## Affected Products

- Linux — Linux (0810d5ad88a18f1e6d549853a388ad0316f74e36)
- Linux — Linux (6.18)
- Linux — Linux (0)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/3043230296653a609ab50006899e64bbb2d99465)
- [CNA](https://git.kernel.org/stable/c/81731f1eda5e6a1dfad31445f741de9bbefbb08e)
- [CNA](https://git.kernel.org/stable/c/70e6a33d68a9b03335c5426332666e52d07f45d6)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.20%
- **EPSS Percentile:** 9.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._