A vulnerability in the Linux kernel's accel/rocket driver causes an out-of-bounds write when cores are unbound and rebound. The issue arises because rocket_remove() decrements the core count while find_core_for_dev() searches only up to the decremented count, causing the last core slot to be skipped. This leads to a stale core count and an out-of-bounds write when rebinding cores, potentially corrupting memory silently.