{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  accel/rocket: search every core slot when a core is removed  rocket_remove() decrements rdev-\u003enum_cores for each core it removes, while find_core_for_dev() searches slots 0 to num_cores - 1. Unbinding the cores in the order they were bound therefore loses the last one: by the time it is removed the search range has already shrunk past its slot, so find_core_for_dev() returns -1 and rocket_remove() gives up without doing anything.  num_cores never reaches zero, rocket_device_fini() never runs, and the file-scoped rdev keeps pointing at a device that is going away. Binding the cores again starts from that stale count, because rocket_probe() takes rdev-\u003enum_cores as the slot to fill. On an RK3588, which describes three cores, the second round lands on slots 1, 2 and 3 while rdev-\u003ecores was allocated with room for three:    rocket fdab0000.npu: Rockchip NPU core 1 version: 1179210309   rocket fdac0000.npu: Rockchip NPU core 2 version: 1179210309   rocket fdad0000.npu: Rockchip NPU core 3 version: 1179210309  The write to rdev-\u003ecores[3] is past the end of the array.  Nothing in tree reads the core array often enough to notice, so the overrun is silent today. It turned up while testing a devfreq series on top of this, where a worker walks every core a few times a second, and UBSAN caught the first bool it read out of the overrun entry:    UBSAN: invalid-load in drivers/accel/rocket/rocket_devfreq.c:47:10   load of value 5 is not a valid value for type '_Bool'   Workqueue: devfreq_wq devfreq_monitor  Record how many slots were allocated and search all of them. Every core is then found on removal, num_cores reaches zero, the device is torn down and a later bind starts from a clean rdev.  This does not make unbinding a single core out of several work. probe still takes num_cores as the slot to fill, so rebinding one core while its siblings stay bound would write over a slot that is already in use, and rocket_open() still reaches for cores[0] whether or not anything is there. Both of those want more thought than a fix should carry.  Found by unbinding and rebinding all three cores on an Orange Pi 5 Plus. With this applied, 25 unbind/rebind rounds and 5 module unload/reload rounds run clean there: the cores land in slots 0, 1 and 2 every time, whichever order they are bound in, and the shared supply goes back to a single user after each round.",
  "id": "DEBIAN-CVE-2026-99184",
  "modified": "2026-10-29T05:47:38.958015114Z",
  "published": "2026-10-28T11:17:39.243Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99184"
    }
  ],
  "upstream": [
    "CVE-2026-99184"
  ]
}