CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved:

accel/rocket: initialize job domain before cleanup paths

rocket_ioctl_submit_job() releases rjob through rocket_job_put() on

allocation error paths. rocket_job_cleanup() unconditionally calls

rocket_iommu_domain_put(job->domain), but job->domain is assigned only

after task copying and BO lookups. A failure before that assignment can

therefore clean up a job with a NULL domain pointer.

Take the per-file domain reference before the first error path can release

rjob. Also clear rjob->tasks after freeing it in rocket_copy_tasks(), so

the common cleanup path cannot free the task array again after a task-copy

error.