The Linux kernel's accel/rocket driver had a use-after-free vulnerability (CVE-2026-64008) caused by premature insertion of a GEM handle into the file's IDR before completing several operations that could fail. If any of these operations fail, the error path frees the GEM object but does not remove the handle from the IDR, resulting in a dangling handle pointing to freed slab memory. Subsequent ioctl calls referencing this handle lead to use-after-free via drm_gem_object_lookup() dereferencing freed memory. The patch moves drm_gem_handle_create() to after all fallible operations succeed, aligning with patterns used in other drivers, and adds a missing error check in drm_mm_insert_node_generic().

The vulnerability allows use-after-free conditions in the Linux kernel's accel/rocket driver, potentially leading to kernel memory corruption or instability when ioctl calls reference freed objects. No known exploits in the wild have been reported. The impact is limited to systems using the affected driver and performing specific ioctl operations that trigger this flaw.

A fix has been implemented in the Linux kernel that moves the GEM handle creation until after all fallible operations succeed and adds missing error checks. Users should update to the fixed Linux kernel version containing this patch. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly stated in the provided data; check the vendor or Linux kernel advisory for the exact fixed version and update accordingly.