The vulnerability in the Linux kernel's accel/rocket subsystem arises from rocket_ioctl_submit_job() releasing a job structure (rjob) on allocation error paths before the job's domain pointer is assigned. The cleanup function rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), which can lead to dereferencing a NULL pointer if the domain was never set. The patch ensures the per-file domain reference is taken before any error path that releases rjob and clears the task array pointer after freeing to avoid double-free during cleanup.

This flaw could cause kernel memory corruption or crashes due to dereferencing a NULL pointer or double-free conditions during error handling in the accel/rocket driver. Such instability could lead to denial of service or potentially escalate to more severe kernel-level impacts depending on exploitation context.

A fix has been applied to the Linux kernel to address this issue by properly initializing the job domain before cleanup and preventing double-free scenarios. Users should update to the patched kernel version once available. Patch status is not explicitly stated in the input; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.