CVE-2026-68437 in Linux
Summary
by MITRE • 08/12/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Fit paired fragment job in the correct CCCB
For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback:
- checks for internal (driver) dependencies for the geometry job; - calls into pvr_queue_get_paired_frag_job_dep() to check for external dependencies for the fragment job (the two jobs are submitted together but the common scheduler code doesn't know about it, so this needs to be done at this point in time); - calls into the prepare_job() callback again, but for the fragment job, to check its internal dependencies as well, passing the fragment job's drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.
The problem with the last step is that pvr_queue_prepare_job() doesn't always take the mismatched fragment job and geometry queue into account, in particular when checking whether there is space for the fragment command to be submitted, so the code ends up checking for space in the geometry (i.e. wrong) CCCB. The rest of the nested prepare_job() callback happens to work fine at the moment as the other internal dependencies are not relevant for a paired fragment job.
Move the initialisation of a paired fragment job's done fence and CCCB fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct queue from the fragment job itself.
This fixes cases where prepare_job() wrongly assumed that there was enough space for a paired fragment job in its own CCCB, unblocking run_job(), which then returned early without writing the full sequence of commands to the CCCB.
The above lead to kernel warnings such as the following and potentially job timeouts (depending on waiters on the missing commands):
[ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63
[ 552.421230] Modules linked in:
[ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT
[ 552.421625] Tainted: [W]=WARN
[ 552.421637] Hardware name: Texas Instruments AM625 SK (DT)
[ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]
[ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]
[ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]
[ 552.421923] sp : ffff800084c47650
[ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000
[ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000
[ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008
[ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000
[ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000
[ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
[ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3
[ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008
[ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000
[ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f
[ 552.422316] Call trace:
[ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)
[ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]
[ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr]
[ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched]
[ 552.422623] process_one_work+0x520/0x1288
[ 552.422657] worker_thread+0x3f0/0xb3c
[ 552.422679] kthread+0x334/0x3d8
[ 552.422706] ret_from_fork+0x10/0x20
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability resides within the Linux kernel's graphics subsystem, specifically in the Direct Rendering Manager (DRM) implementation for Imagination Technologies' PowerVR GPU drivers. This issue manifests when handling geometry jobs that are paired with fragment jobs, a common pattern in 3D graphics rendering where both types of operations must be executed together to produce correct visual output. The core problem lies in how the DRM scheduler's prepare_job() callback manages dependencies and resource allocation for these paired jobs.
The technical flaw occurs during the preparation phase of job execution when the system attempts to verify sufficient space within the Command Context Command Buffer (CCCB) for the fragment job component. The current implementation fails to correctly identify which CCCB should be checked for available space, instead defaulting to the geometry job's CCCB. This misalignment leads to incorrect resource allocation decisions and ultimately causes command submission failures. According to CWE-129, this represents an improper input validation issue where the system assumes incorrect context for resource management operations.
The operational impact of this vulnerability is significant as it results in kernel warnings and potential job timeouts that disrupt graphics processing workflows. The warning trace shows the failure occurring in pvr_cccb_write_command_with_header function, indicating that when insufficient space is incorrectly assumed for the fragment job's CCCB, the system attempts to write commands beyond allocated capacity. This leads to early termination of job execution without completing all necessary graphical operations, causing visual artifacts or complete rendering failures depending on the application context.
The mitigation strategy involves restructuring the dependency checking mechanism by moving the initialization of paired fragment job fences and CCCB management into the pvr_queue_get_paired_frag_job_dep() function. This change ensures that the correct queue context is always used when determining resource availability, eliminating the mismatch between geometry and fragment job CCCB references. The fix aligns with ATT&CK technique T1059.001 for privilege escalation through kernel exploitation, as it prevents potential denial-of-service conditions that could be exploited by malicious actors to disrupt graphics rendering. This vulnerability demonstrates the critical importance of proper resource context management in GPU driver implementations and highlights how seemingly minor dependency handling errors can cascade into system stability issues.
The root cause stems from improper state tracking within the scheduler's job preparation logic, where external dependency checks do not account for the distinct queue contexts required by paired jobs. This misconfiguration affects the broader DRM subsystem and potentially impacts all applications utilizing PowerVR graphics hardware through the kernel's scheduling mechanisms. The fix ensures proper fence initialization and CCCB context resolution at the point where fragment job dependencies are first evaluated, preventing the premature job termination that was causing system instability.