{"id":"CVE-2026-99210","kind":"vulnerability","aliases":["CVE-2026-99210"],"related":[],"title":"Linux kernel rocket accelerator driver: failed init leaves dangling error pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: clear rdev on device init failure\n\nrocket_probe() stores the return value from rocket_device_init() in the\nfile-scoped rdev pointer before checking whether it is an error pointer.\nIf rocket_device_init() fails, rdev is left as an ERR_PTR.\n\nThe rdev pointer is also used as the marker for whether the shared rocket\ndevice has already been initialized. A later core probe can therefore see\na non-NULL rdev, skip rocket_device_init(), and dereference the error\npointer when reading rdev->num_cores.\n\nSave the error code and clear rdev before returning from the\nrocket_device_init() failure path.","summary":"In the Linux kernel's rocket accelerator driver, a failed device initialization leaves an error pointer stored in a shared variable, which a later probe can dereference. The sources do not state what an attacker can gain from this, beyond a crash-type fault in the kernel driver path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-rockchip","infrastructure","linux-kernel","rocket-driver"],"not_affected_if":["driver-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'accel/rocket: clear rdev on device init failure'.","status":"open","published_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:51+00:00","updated_at":"2026-10-28T11:33:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:33:51Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'accel/rocket: clear rdev on device init failure'.","reach":"local","title":"Linux kernel rocket accelerator driver: failed init leaves dangling error pointer","impact":"medium","summary":"In the Linux kernel's rocket accelerator driver, a failed device initialization leaves an error pointer stored in a shared variable, which a later probe can dereference. The sources do not state what an attacker can gain from this, beyond a crash-type fault in the kernel driver path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","rocket-driver","arm-rockchip"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel null-style dereference during probe; possible crash or worse","analyst_note":"Check the upstream kernel commit and NVD entry for the exact affected version range and whether the fault is a crash only or allows more.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the accel/rocket driver (the Rockchip NPU accelerator) loaded. Systems without that hardware or driver are unlikely to be exposed. The sources do not give further detail.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00059,"input_tokens":3446,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99210':14A,17A 'accel/rocket':88C 'acceler':4A,34B 'alreadi':148C 'also':136C 'arm':19B 'arm-rockchip':18B 'attack':62B 'beyond':67B 'check':113C 'clear':89C,182C 'code':180C 'core':153C,176C 'crash':70B 'crash-typ':69B 'cve':12A,15A 'dangl':9A 'derefer':54B,168C 'devic':38B,92C,103C,122C,146C,165C,189C 'driver':5A,27B,35B,76B 'err':130C 'error':10A,42B,118C,170C,179C 'fail':6A,37B,124C 'failur':94C,191C 'fault':72B 'file':108C 'file-scop':107C 'follow':83C 'gain':64B 'infrastructur':21B 'init':7A,93C,104C,123C,166C,190C 'initi':39B,150C 'kernel':2A,24B,31B,75B,81C 'later':51B,152C 'leav':8A,40B 'left':127C 'linux':1A,23B,30B,80C 'linux-kernel':22B 'marker':140C 'non':160C 'non-nul':159C 'null':161C 'num':175C 'path':77B,192C 'pointer':11A,43B,111C,119C,134C,171C 'probe':52B,96C,154C 'ptr':131C 'rdev':90C,110C,125C,133C,162C,174C,183C 'read':173C 'resolv':87C 'return':99C,185C 'rockchip':20B 'rocket':3A,26B,33B,95C,102C,121C,145C,164C,188C 'rocket-driv':25B 'save':177C 'scope':109C 'see':157C 'share':47B,144C 'skip':163C 'sourc':56B 'state':59B 'store':44B,97C 'therefor':156C 'type':71B 'use':137C 'valu':100C 'variabl':48B 'vulner':84C 'whether':114C,142C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the accel/rocket driver (the Rockchip NPU accelerator) loaded. Systems without that hardware or driver are unlikely to be exposed. The sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99210","severity":null,"published_at":"2026-10-28T11:17:42+00:00","modified_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}