Live › vulnerability › CVE-2026-99210
Go to dashboardIn the Linux kernel's rocket accelerator driver, a failed device initialization leaves an error pointer stored in a shared variable, which a later probe can dereference. The sources do not state what an attacker can gain from this, beyond a crash-type fault in the kernel driver path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the accel/rocket driver (the Rockchip NPU accelerator) loaded. Systems without that hardware or driver are unlikely to be exposed. The sources do not give further detail.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: clear rdev on device init failure
rocket_probe() stores the return value from rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. If rocket_device_init() fails, rdev is left as an ERR_PTR.
The rdev pointer is also used as the marker for whether the shared rocket device has already been initialized. A later core probe can therefore see a non-NULL rdev, skip rocket_device_init(), and dereference the error pointer when reading rdev->num_cores.
Save the error code and clear rdev before returning from the rocket_device_init() failure path.
This page as .md · .json · in your agent: get_signal("CVE-2026-99210")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.