Cloudanix VulnDB

CVE-2026-99183

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel driver for certain AI accelerator chips can cause the whole system to crash when one processing core is removed while others are still running jobs.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in sched_to_core() after partial core unbind decrements num_cores without adjusting the search range, causing rocket_job_run() and rocket_job_timedout() to dereference a NULL core pointer.

Why it matters to the business

Kernel crashes and system instability on Rockchip RK3588 and similar NPU hardware during driver unload or core management operations, leading to service disruption and potential data loss in workloads using the accelerator.

How an attack unfolds

An attacker with local access triggers unbinding of a non-final core via device removal while jobs are active on remaining cores; the subsequent job scheduling or timeout paths then hit the unchecked NULL return from sched_to_core(), producing the dereference.

How to fix it

Apply the upstream fix that changes sched_to_core() to walk all allocated slots instead of up to the current num_cores value; rebuild and deploy the updated kernel module.

How to confirm the fix worked

Confirm the patched sched_to_core() implementation searches the full rdev->cores[] array; re-test core unbind scenarios under load and verify absence of null dereference KASAN reports.

Typical attack path

  1. Obtain local access and load the rocket driver on multi-core NPU hardware
  2. Submit jobs to all cores from multiple clients
  3. Unbind a middle core while jobs remain queued on others
  4. Trigger job run or timeout paths that call sched_to_core()
  5. Cause null dereference and kernel panic

How to detect it

Inspect kernel logs for KASAN null-ptr-deref reports referencing rocket_job_run or rocket_job_timedout inside drm_sched workqueues; correlate with device unbind events for the rocket or NPU driver.

What your security team should do

  • Prioritize kernel update containing the accel/rocket fix on all systems with Rockchip NPUs
  • Restrict unprivileged access to NPU device nodes until patched
  • Monitor for drm_sched and rocket workqueue crashes in kernel logs

The record

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler sched_to_core() walks rdev->cores[] up to rdev->num_cores, and rocket_remove() decrements num_cores for every core it removes. Unbind a core that is not the last one and the cores behind it fall outside the search, so sched_to_core() returns NULL for a core that is still bound and still running jobs. Neither caller checks the result: rocket_job_run(): rocket_fence_create(core), core->dev rocket_job_timedout(): dev_err(core->dev, "NPU job timed out") Unbinding the middle core of the three on an RK3588 while three clients are submitting to all of them faults twice, once from the surviving core's job queue and once from its reset work: KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227] Workqueue: fdad0000.npu drm_sched_run_job_work [gpu_sched] pc : rocket_job_run+0x234/0x838 [rocket] Call trace: rocket_job_run+0x234/0x838 [rocket] drm_sched_run_job_work+0x2cc/0xad8 [gpu_sched] process_one_work+0x640/0x14f0 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: rocket-reset-2 drm_sched_job_timedout [gpu_sched] pc : rocket_job_timedout+0xf0/0x1e0 [rocket] Call trace: rocket_job_timedout+0xf0/0x1e0 [rocket] drm_sched_job_timedout+0x188/0x6a0 [gpu_sched] Both are the third core: the workqueue names are its device and its core->index, and it was left at slot 2 while num_cores had dropped to 2. Search all the slots that were allocated, the way find_core_for_dev() now does. A core that is still bound is then found, and the two callers get the pointer they already assume they have. This does not make unbinding one core out of several safe. An open client keeps an entity pointing at the scheduler of the core that went away: drm_sched reports it as not ready for every job that lands on it, and the client waits in dma_fence_default_wait for a fence that will never signal. Stopping the NULL dereference is what belongs in a fix; the rest wants more thought.

Affected packages

Ecosystem Package Introduced Fixed