Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-23305

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (as could be the case with EPROBE_DEFER), we need to properly unwind by decrementing the counter we just incremented and if this is the first core we failed to probe, remove the rocket DRM device with rocket_device_fini() as well. This matches the logic in rocket_remove(). Failing to properly unwind results in out-of-bounds accesses.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:28471410cc260a38002ec6ec756fa873fe3359c7cb619aaa7f33b48682c04356
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/accel/rocket/rocket_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.17","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_f…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/accel/rocket/rocket_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7fc4b49474c836cee7d9801abf05e0198fcbfa74","status":"affected","version":"0810d5ad88a18f1e6d549853a388ad0316f74e36","versionType":"git"},{"lessThan":"eeaf28c8f4defe371a008a5ddefaf18abf534f81","status":"affected","version":"0810d5ad88a18f1e6d549853a388ad0316f74e36","versionType":"git"},{"lessThan":"34f4495a7f72895776b81969639f527c99eb12b9","status":"affected","version":"0810d5ad88a1…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/accel/rocket/rocket_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.17","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_f…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/accel/rocket/rocket_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7fc4b49474c836cee7d9801abf05e0198fcbfa74","status":"affected","version":"0810d5ad88a18f1e6d549853a388ad0316f74e36","versionType":"git"},{"lessThan":"eeaf28c8f4defe371a008a5ddefaf18abf534f81","status":"affected","version":"0810d5ad88a18f1e6d549853a388ad0316f74e36","versionType":"git"},{"lessThan":"34f4495a7f72895776b81969639f527c99eb12b9","status":"affected","version":"0810d5ad88a1…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/affected/0

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/34f4495a7f72895776b81969639f527c99eb12b9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/7fc4b49474c836cee7d9801abf05e0198fcbfa74"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/eeaf28c8f4defe371a008a5ddefaf18abf534f81"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ee3218ba449f48932a72677e4ea644ad79bd285fa0fbf0b360f41db8ce19ce · sha256:84896ce17335b0fc… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer