CVE-2026-68263 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Fix double call to drm_sched_entity_fini()
Call sequence of double call: pvr_context_destroy pvr_context_kill_queues pvr_queue_kill drm_sched_entity_destroy drm_sched_entity_fini // here pvr_context_put kref_put(..., pvr_context_release) pvr_context_destroy_queues pvr_queue_destroy drm_sched_entity_fini // here
Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls drm_sched_entity_flush() + drm_sched_entity_fini(). drm_sched_entity_flush() ensures all pending jobs are completed and drm_sched_entity_fini() ensures no further submission is allowed as per expectation from pvr_context_kill_queues(). Double call to drm_sched_entity_fini() is misuse of the API so keep call only in pvr_context_create() failure path.
Stack trace for issue with addition of refcounting for DRM entity stats in commit fd177135f0e6 ("drm/sched: Account entity GPU time"):
[ 789.490527] ------------[ cut here ]------------
[ 789.490559] refcount_t: underflow; use-after-free.
[ 789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440
[ 789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6
[ 789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT
[ 789.490809] Hardware name: Texas Instruments AM625 SK (DT)
[ 789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr]
[ 789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 789.490876] pc : refcount_warn_saturate+0xf4/0x144
[ 789.490884] lr : refcount_warn_saturate+0xf4/0x144
[ 789.490892] sp : ffff8000822cbcc0
[ 789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000
[ 789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405
[ 789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30
[ 789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768
[ 789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0
[ 789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211
[ 789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30
[ 789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49
[ 789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010
[ 789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000
[ 789.491027] Call trace:
[ 789.491032] refcount_warn_saturate+0xf4/0x144 (P)
[ 789.491043] drm_sched_entity_fini+0x164/0x18c [gpu_sched]
[ 789.491081] pvr_queue_destroy+0x64/0x134 [powervr]
[ 789.491110] pvr_context_destroy_queues+0x34/0x64 [powervr]
[ 789.491138] pvr_context_release+0x70/0xac [powervr]
[ 789.491166] pvr_context_put.part.0+0x5c/0x7c [powervr]
[ 789.491193] pvr_context_put+0x14/0x24 [powervr]
[ 789.491221] pvr_queue_fence_release_work+0x20/0x38 [powervr]
[ 789.491249] process_one_work+0x160/0x4c4
[ 789.491264] worker_thread+0x188/0x310
[ 789.491276] kthread+0x130/0x13c
[ 789.491287] ret_from_fork+0x10/0x20
[ 789.491300] ---[ end trace 0000000000000000 ]---
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described in this CVE relates to a double call to the drm_sched_entity_fini() function within the Linux kernel's PowerVR graphics driver implementation. This issue manifests in the drm/imagination subsystem where improper resource management leads to a use-after-free condition. The root cause stems from the pvr_context_destroy function sequence which invokes drm_sched_entity_destroy, thereby triggering drm_sched_entity_fini as part of its cleanup process. Subsequently, during context release operations, another call to drm_sched_entity_fini occurs through pvr_queue_destroy, creating an improper double invocation that violates the intended API usage patterns.
The technical flaw represents a classic violation of resource management principles where the same cleanup function is called twice on the same object. This results in corrupted reference counting mechanisms within the DRM subsystem, specifically in the gpu_sched module. The refcount_t underflow error indicates that the internal reference counter has been decremented beyond zero, which typically occurs when memory is freed more than once or when cleanup functions are invoked incorrectly. According to CWE-415: Double Free and CWE-416: Use After Free, this vulnerability directly maps to improper resource handling patterns that can lead to system instability and potential security exploits.
The operational impact of this vulnerability extends beyond simple kernel panics as demonstrated by the stack trace showing a warning issued from lib/refcount.c. The underflow condition indicates that memory management structures have been corrupted, potentially leading to data corruption or arbitrary code execution in kernel space. This type of vulnerability can be exploited by malicious actors to gain unauthorized access to system resources or cause denial of service conditions. The PowerVR graphics driver context is particularly vulnerable because it handles GPU scheduling and entity management where improper cleanup can affect the entire graphics subsystem.
Mitigation strategies for this vulnerability require careful examination of the driver's resource management flow and proper implementation of defensive programming practices. The fix involves removing the redundant drm_sched_entity_fini() call from the pvr_queue_destroy function path, ensuring that this cleanup routine is only invoked in the appropriate failure scenarios during context creation rather than in the normal destruction sequence. This aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation and requires kernel-level patching to prevent improper API usage patterns.
The fix demonstrates proper defensive programming practices by ensuring that cleanup functions are called exactly once per resource lifecycle, preventing both double-free conditions and use-after-free scenarios. This type of vulnerability highlights the importance of maintaining proper reference counting mechanisms in kernel drivers and understanding the intended usage patterns of complex subsystem APIs like those found in the DRM scheduler framework. The solution emphasizes the need for rigorous code review processes and automated testing to prevent similar issues in other driver components where resource management patterns may be similarly flawed.