{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  accel/rocket: Fix error path handling in rocket_job_run()  In rocket_job_run(), after taking an extra fence reference for job-\u003edone_fence via dma_fence_get(), the error paths have three bugs:  - The dma_fence reference held by job-\u003edone_fence is never released,   causing a reference leak. - pm_runtime_get_sync() increments the usage counter even on failure,   but the error path does not decrement it, leaking the runtime PM   reference and preventing the NPU from suspending. - A valid but unsignaled fence is returned to the DRM scheduler,   which triggers WARN(\"Fence ... released with pending signals!\")   when the scheduler drops its reference.  Fix by replacing pm_runtime_get_sync() with pm_runtime_resume_and_get() which auto-balances the usage counter on failure, releasing both fence references on error, and returning ERR_PTR(ret) instead of the unsignaled fence.  [tomeu: Refactored error paths to use consolidated goto labels]",
  "id": "DEBIAN-CVE-2026-89590",
  "modified": "2026-09-12T08:47:21.197275005Z",
  "published": "2026-09-11T20:19:43.567Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89590"
    }
  ],
  "upstream": [
    "CVE-2026-89590"
  ]
}