CVE-2026-89590 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel-based systems should assess their exposure to CVE-2026-89590 and verify if their versions are patched or vulnerable.

Why it matters

CVE-2026-89590 is a Linux kernel vulnerability in the accel/rocket component. It has been addressed with fixes for error path handling issues. Linux kernel maintainers and users should assess exposure and verify patched versions.

• Verify patched Linux kernel versions to prevent potential reference leaks
• Assess system configurations for workarounds or compensating controls
• Review Linux kernel installations for exposure to CVE-2026-89590

Technical summary

The `rocket_job_run()` function in the Linux kernel's accel/rocket component had multiple error path handling issues. These included a dma_fence reference leak due to not releasing the reference held by `job->done_fence`, an unbalanced runtime PM usage counter because `pm_runtime_get_sync()` increments the counter even on failure without being decremented in the error path, and returning a valid but unsignaled fence to the DRM scheduler. These issues could lead to reference leaks, prevent the NPU from suspending, and trigger warnings when the scheduler drops its reference. The fixes involve replacing `pm_runtime_get_sync()` with `pm_runtime_resume_and_get()` to auto-balance the usage counter on failure, releasing both fence references on error, and returning `ERR_PTR(ret)` instead of the unsignaled fence.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patched versions.

Recommended defensive actions

• Assess exposure of Linux kernel installations to CVE-2026-89590
• Verify if running Linux kernel versions are patched or vulnerable
• Review system configurations for potential workarounds or compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. Three source references from the Linux kernel Git repository are provided, detailing the changes made to address the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.