Skip to main content
VulnerabilityPublished Updated

CVE-2026-99184: Linux kernel · accel/rocket: search every core slot when a core is removed

Affects Linux kernelSource GCVE Database

0
Compare
Authoritative record:CVE-2026-99184· Medium

Not known to be exploited.

Data as of 30 Oct 2026, 03:46 UTC

Severity
Medium

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 28 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

Affected software

ProductAffectedFixed in
Ubuntu 26.10linuxpkg:deb/ubuntu/linux?arch=source&distro=stonkingOther threatsAffected
  • 7.0.0-14.14 – 7.3.0-10.10
7 affected builds
Fixed in–
Ubuntu 26.10linux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=stonkingOther threatsAffected
  • 7.0.0-1004.4 – 7.3.0-1004.4
6 affected builds
Fixed in–
Ubuntu 26.10linux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=stonkingOther threatsAffected
  • 7.0.0-1004.4 – 7.3.0-1004.4
6 affected builds
Fixed in–
Ubuntu 26.10linux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonkingOther threatsAffected
  • 7.0.0-1004.4 – 7.3.0-1004.5
4 affected builds
Fixed in–
Ubuntu 26.10linux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=stonkingOther threatsAffected
  • 7.0.0-1003.3 – 7.3.0-1004.4
6 affected builds
Fixed in–
Ubuntu 26.10linux-oraclepkg:deb/ubuntu/linux-oracle?arch=source&distro=stonkingOther threatsAffected
  • 7.0.0-1003.3 – 7.3.0-1004.4
6 affected builds
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix has been applied that records the number of allocated core slots and searches all of them during core removal, ensuring proper device teardown and preventing stale references and buffer overruns. Users should update to kernel versions that include this fix. No additional mitigation steps are indicated. Note that rebinding a single core while others remain bound may still cause issues and requires further fixes.

Description

CVE-2026-99184 is a vulnerability in the Linux kernel's accel/rocket driver where improper handling of core removal leads to an out-of-bounds write. The issue arises because the code does not search all core slots when a core is removed, causing stale references and array overruns. This can result in silent memory corruption during core unbinding and rebinding operations. The flaw was found on RK3588 devices and Orange Pi 5 Plus during testing. A fix involves recording the number of allocated slots and searching all of them to ensure proper teardown and rebinding of cores.

References

Community reviews

Loading reviews…