CVE-2026-99184
NoneCVSS
—
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel driver for certain Rockchip AI chips can let repeated unplug-and-replug actions corrupt memory and crash the system.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds write into the rdev->cores array in the rocket NPU driver when cores are unbound and rebound; num_cores tracking shrinks the search range on removal but probe still indexes from the stale count, writing past the allocated slots.
Why it matters to the business
Kernel memory corruption or crashes on Rockchip NPU-equipped systems during device removal or module reload operations, potentially causing system instability or denial of service in edge, embedded, or AI accelerator workloads.
How an attack unfolds
An attacker with sufficient privileges to unbind and rebind the NPU device nodes repeatedly triggers the flawed slot calculation in rocket_remove and rocket_probe, causing the driver to write core structures beyond the end of the allocated array and corrupt adjacent kernel memory.
How to fix it
Apply the upstream fix that records the originally allocated slot count separately from num_cores and searches the full allocation range on removal; rebuild and deploy the corrected kernel on all affected Rockchip NPU systems.
How to confirm the fix worked
Confirm the patch is present by inspecting drivers/accel/rocket/rocket_core.c for the new allocated-slot tracking logic; exercise repeated unbind/rebind cycles on an RK3588-class device and verify num_cores reaches zero and no UBSAN reports occur.
Typical attack path
- Obtain privileges to unbind PCI or platform devices or unload the rocket module
- Repeatedly unbind all NPU cores in the order they were originally bound
- Rebind the cores, causing probe to index beyond the allocated cores array
- Trigger workloads that walk the cores array to surface or exploit the resulting memory corruption
How to detect it
Search kernel logs and dmesg for UBSAN reports mentioning rocket_devfreq.c or invalid boolean loads from the core array; look for repeated bind/unbind sequences of fdab0000.npu-style devices followed by unexpected oops or memory corruption.
What your security team should do
- Prioritize patching systems that expose the rocket NPU driver to unprivileged users or container workloads
- Monitor kernel logs for UBSAN invalid-load reports referencing rocket_devfreq.c or similar core-array accesses
- Restrict device unbind capabilities via udev rules or SELinux policies until the fix is deployed
The record
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocket_remove() decrements rdev->num_cores for each core it removes, while find_core_for_dev() searches slots 0 to num_cores - 1. Unbinding the cores in the order they were bound therefore loses the last one: by the time it is removed the search range has already shrunk past its slot, so find_core_for_dev() returns -1 and rocket_remove() gives up without doing anything. num_cores never reaches zero, rocket_device_fini() never runs, and the file-scoped rdev keeps pointing at a device that is going away. Binding the cores again starts from that stale count, because rocket_probe() takes rdev->num_cores as the slot to fill. On an RK3588, which describes three cores, the second round lands on slots 1, 2 and 3 while rdev->cores was allocated with room for three: rocket fdab0000.npu: Rockchip NPU core 1 version: 1179210309 rocket fdac0000.npu: Rockchip NPU core 2 version: 1179210309 rocket fdad0000.npu: Rockchip NPU core 3 version: 1179210309 The write to rdev->cores[3] is past the end of the array. Nothing in tree reads the core array often enough to notice, so the overrun is silent today. It turned up while testing a devfreq series on top of this, where a worker walks every core a few times a second, and UBSAN caught the first bool it read out of the overrun entry: UBSAN: invalid-load in drivers/accel/rocket/rocket_devfreq.c:47:10 load of value 5 is not a valid value for type '_Bool' Workqueue: devfreq_wq devfreq_monitor Record how many slots were allocated and search all of them. Every core is then found on removal, num_cores reaches zero, the device is torn down and a later bind starts from a clean rdev. This does not make unbinding a single core out of several work. probe still takes num_cores as the slot to fill, so rebinding one core while its siblings stay bound would write over a slot that is already in use, and rocket_open() still reaches for cores[0] whether or not anything is there. Both of those want more thought than a fix should carry. Found by unbinding and rebinding all three cores on an Orange Pi 5 Plus. With this applied, 25 unbind/rebind rounds and 5 module unload/reload rounds run clean there: the cores land in slots 0, 1 and 2 every time, whichever order they are bound in, and the shared supply goes back to a single user after each round.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|