CVE-2026-68281 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Count paired job fence as dependency in prepare_job()
The DRM scheduler's prepare_job() callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those (plus job data and fence update) can fit in the job queue's CCCB.
This means checking which dependencies can be waited upon in the firmware, i.e. whether they are backed by a UFO object, i.e. whether their drm_sched_fence::parent has been assigned to a pvr_queue_fence::base fence. That happens when the job owning the fence is submitted to the firmware.
Paired geometry and fragment jobs are submitted at the same time, which means the dependency between them can't be checked this way before submission.
Update job_count_remaining_native_deps() to take into account the dependency between paired jobs.
This fixes cases where prepare_job() underestimated the space left in an almost full fragment CCCB, wrongly unblocking run_job(), which then returned early without writing the full sequence of commands to the CCCB.
The above lead to kernel warnings such as the following and potentially job timeouts (depending on waiters on the missing commands):
[ 375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47
[ 375.703160] Modules linked in:
[ 375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G W 7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT
[ 375.703613] Tainted: [W]=WARN
[ 375.703627] Hardware name: Texas Instruments AM625 SK (DT)
[ 375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]
[ 375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]
[ 375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]
[ 375.703921] sp : ffff800084a97650
[ 375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000
[ 375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000
[ 375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008
[ 375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000
[ 375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000
[ 375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
[ 375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3
[ 375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008
[ 375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000
[ 375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f
[ 375.704317] Call trace:
[ 375.704331] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)
[ 375.704411] pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]
[ 375.704487] pvr_queue_run_job+0x3a4/0x990 [powervr]
[ 375.704562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]
[ 375.704623] process_one_work+0x520/0x1288
[ 375.704658] worker_thread+0x3f0/0xb3c
[ 375.704680] kthread+0x334/0x3d8
[ 375.704706] ret_from_fork+0x10/0x20
[ 375.704736] ---[ end trace 0000000000000000 ]---
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the Linux kernel's graphics subsystem, specifically in the Direct Rendering Manager (DRM) implementation for Imagination Technologies' PowerVR GPU drivers. This issue manifests as an incorrect calculation of job dependencies during the preparation phase of GPU job scheduling, leading to premature job execution and potential command buffer corruption.
The core flaw is located in the drm/imagination driver's prepare_job() callback function which manages the job queue's CCCB (Command Control Buffer). The function tracks native dependencies that must be resolved before job submission, but fails to account for paired geometry and fragment jobs that are submitted simultaneously. This oversight causes the system to underestimate available space in the CCCB, resulting in jobs being unblocked prematurely without proper command sequence writing.
This vulnerability stems from a fundamental misunderstanding of job dependency relationships within the PowerVR scheduler architecture. When paired jobs are submitted together, their interdependence cannot be evaluated through standard firmware dependency checking mechanisms because these checks rely on UFO objects and drm_sched_fence::parent assignments that only occur upon actual firmware submission. The update to job_count_remaining_native_deps() addresses this by incorporating paired job dependencies into the space calculation.
The technical impact of this flaw can be severe, as evidenced by kernel warnings indicating memory corruption in pvr_cccb_write_command_with_header function. These warnings typically manifest when the CCCB receives incomplete command sequences due to premature job execution. The system may experience job timeouts or complete GPU hangs depending on how waiters are configured for missing commands. The error trace shows the issue originates from workqueue processing within drm_sched_run_job_work, indicating this is a scheduler-level problem affecting job lifecycle management.
According to CWE classification, this represents a weakness in resource management where insufficient dependency tracking leads to buffer overflow conditions and memory corruption. From an ATT&CK perspective, this vulnerability could enable privilege escalation or denial of service through GPU process manipulation, as it affects the fundamental scheduling mechanism that governs graphics processing. The issue particularly impacts systems utilizing PowerVR GPUs with the drm/imagination driver, where job submission timing and dependency resolution are critical for proper hardware operation.
The fix requires modifying the dependency counting logic to properly account for paired job relationships during preparation phase. This ensures that when geometry and fragment jobs are submitted together, their inherent dependency relationship is considered in CCCB space calculations. The mitigation strategy focuses on updating kernel driver code to maintain consistency between job scheduling decisions and actual command buffer requirements. System administrators should ensure timely kernel updates to address this vulnerability, particularly in environments relying heavily on PowerVR GPU acceleration where proper job sequencing is essential for stable operation and preventing potential denial of service conditions through GPU scheduler corruption.