The Linux kernel's accel/rocket subsystem had a vulnerability in the rocket_job_push() function. This function allocates a temporary array to hold pointers to input and output GEM objects. Two bugs were present: first, a missing NULL check after kvmalloc_array() could cause a kernel NULL pointer dereference if allocation failed. Second, an integer overflow could occur when summing user-supplied in_bo_count and out_bo_count values (both u32), causing the allocation size to wrap to a smaller number. This mismatch between allocated size and actual counts could lead to out-of-bounds accesses on the temporary array. The vulnerability was fixed by adding check_add_overflow() to detect overflow before allocation and adding a NULL check on the allocation result.

If exploited, the vulnerability could cause a kernel NULL pointer dereference leading to a denial of service (kernel crash). The integer overflow could also lead to out-of-bounds memory access, potentially causing memory corruption or other undefined behavior. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by adding overflow checks and NULL pointer validation. Users and administrators should apply the official kernel updates containing this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation.