GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68281 (GCVE-0-2026-68281)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-17 05:02
VLAI
Title
drm/imagination: Count paired job fence as dependency in prepare_job()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in prepare_job() The DRM scheduler's prepare_job() callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those (plus job data and fence update) can fit in the job queue's CCCB. This means checking which dependencies can be waited upon in the firmware, i.e. whether they are backed by a UFO object, i.e. whether their drm_sched_fence::parent has been assigned to a pvr_queue_fence::base fence. That happens when the job owning the fence is submitted to the firmware. Paired geometry and fragment jobs are submitted at the same time, which means the dependency between them can't be checked this way before submission. Update job_count_remaining_native_deps() to take into account the dependency between paired jobs. This fixes cases where prepare_job() underestimated the space left in an almost full fragment CCCB, wrongly unblocking run_job(), which then returned early without writing the full sequence of commands to the CCCB. The above lead to kernel warnings such as the following and potentially job timeouts (depending on waiters on the missing commands): [ 375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47 [ 375.703160] Modules linked in: [ 375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G W 7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT [ 375.703613] Tainted: [W]=WARN [ 375.703627] Hardware name: Texas Instruments AM625 SK (DT) [ 375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched] [ 375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] [ 375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr] [ 375.703921] sp : ffff800084a97650 [ 375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000 [ 375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000 [ 375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008 [ 375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000 [ 375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000 [ 375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3 [ 375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008 [ 375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000 [ 375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f [ 375.704317] Call trace: [ 375.704331] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P) [ 375.704411] pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr] [ 375.704487] pvr_queue_run_job+0x3a4/0x990 [powervr] [ 375.704562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched] [ 375.704623] process_one_work+0x520/0x1288 [ 375.704658] worker_thread+0x3f0/0xb3c [ 375.704680] kthread+0x334/0x3d8 [ 375.704706] ret_from_fork+0x10/0x20 [ 375.704736] ---[ end trace 0000000000000000 ]---
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 02b0da249c8f78d2bbf9f498bbd371c66142b0af (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 943fa73ea0efa335d9c1800fcfac47915de4ff89 (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < a673171502e87acb5a9e2923f4cf9dce521fd05e (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 9cd74f935306cd857f46686975c43383e1d95f94 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "02b0da249c8f78d2bbf9f498bbd371c66142b0af",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "943fa73ea0efa335d9c1800fcfac47915de4ff89",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "a673171502e87acb5a9e2923f4cf9dce521fd05e",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "9cd74f935306cd857f46686975c43383e1d95f94",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_queue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Count paired job fence as dependency in prepare_job()\n\nThe DRM scheduler\u0027s prepare_job() callback counts the remaining\nnon-signaled native dependencies for a job, preventing job submission\nuntil those (plus job data and fence update) can fit in the job queue\u0027s\nCCCB.\n\nThis means checking which dependencies can be waited upon in the\nfirmware, i.e. whether they are backed by a UFO object, i.e. whether\ntheir drm_sched_fence::parent has been assigned to a\npvr_queue_fence::base fence. That happens when the job owning the fence\nis submitted to the firmware.\n\nPaired geometry and fragment jobs are submitted at the same time, which\nmeans the dependency between them can\u0027t be checked this way before\nsubmission.\n\nUpdate job_count_remaining_native_deps() to take into account the\ndependency between paired jobs.\n\nThis fixes cases where prepare_job() underestimated the space left in\nan almost full fragment CCCB, wrongly unblocking run_job(), which then\nreturned early without writing the full sequence of commands to the\nCCCB.\n\nThe above lead to kernel warnings such as the following and potentially\njob timeouts (depending on waiters on the missing commands):\n\n  [  375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47\n  [  375.703160] Modules linked in:\n  [  375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G        W           7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT\n  [  375.703613] Tainted: [W]=WARN\n  [  375.703627] Hardware name: Texas Instruments AM625 SK (DT)\n  [  375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\n  [  375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\n  [  375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]\n  [  375.703921] sp : ffff800084a97650\n  [  375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000\n  [  375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000\n  [  375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008\n  [  375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000\n  [  375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\n  [  375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  [  375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\n  [  375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008\n  [  375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000\n  [  375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\n  [  375.704317] Call trace:\n  [  375.704331]  pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\n  [  375.704411]  pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]\n  [  375.704487]  pvr_queue_run_job+0x3a4/0x990 [powervr]\n  [  375.704562]  drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\n  [  375.704623]  process_one_work+0x520/0x1288\n  [  375.704658]  worker_thread+0x3f0/0xb3c\n  [  375.704680]  kthread+0x334/0x3d8\n  [  375.704706]  ret_from_fork+0x10/0x20\n  [  375.704736] ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:15.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/02b0da249c8f78d2bbf9f498bbd371c66142b0af"
        },
        {
          "url": "https://git.kernel.org/stable/c/943fa73ea0efa335d9c1800fcfac47915de4ff89"
        },
        {
          "url": "https://git.kernel.org/stable/c/a673171502e87acb5a9e2923f4cf9dce521fd05e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cd74f935306cd857f46686975c43383e1d95f94"
        }
      ],
      "title": "drm/imagination: Count paired job fence as dependency in prepare_job()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68281",
    "datePublished": "2026-08-10T12:02:13.103Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-17T05:02:15.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68281",
      "date": "2026-09-10",
      "epss": "0.00175",
      "percentile": "0.07166"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68281\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:17.303\",\"lastModified\":\"2026-08-17T05:18:30.697\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/imagination: Count paired job fence as dependency in prepare_job()\\n\\nThe DRM scheduler\u0027s prepare_job() callback counts the remaining\\nnon-signaled native dependencies for a job, preventing job submission\\nuntil those (plus job data and fence update) can fit in the job queue\u0027s\\nCCCB.\\n\\nThis means checking which dependencies can be waited upon in the\\nfirmware, i.e. whether they are backed by a UFO object, i.e. whether\\ntheir drm_sched_fence::parent has been assigned to a\\npvr_queue_fence::base fence. That happens when the job owning the fence\\nis submitted to the firmware.\\n\\nPaired geometry and fragment jobs are submitted at the same time, which\\nmeans the dependency between them can\u0027t be checked this way before\\nsubmission.\\n\\nUpdate job_count_remaining_native_deps() to take into account the\\ndependency between paired jobs.\\n\\nThis fixes cases where prepare_job() underestimated the space left in\\nan almost full fragment CCCB, wrongly unblocking run_job(), which then\\nreturned early without writing the full sequence of commands to the\\nCCCB.\\n\\nThe above lead to kernel warnings such as the following and potentially\\njob timeouts (depending on waiters on the missing commands):\\n\\n  [  375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47\\n  [  375.703160] Modules linked in:\\n  [  375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G        W           7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT\\n  [  375.703613] Tainted: [W]=WARN\\n  [  375.703627] Hardware name: Texas Instruments AM625 SK (DT)\\n  [  375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\\n  [  375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n  [  375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\\n  [  375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]\\n  [  375.703921] sp : ffff800084a97650\\n  [  375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000\\n  [  375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000\\n  [  375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008\\n  [  375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000\\n  [  375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\\n  [  375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n  [  375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\\n  [  375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008\\n  [  375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000\\n  [  375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\\n  [  375.704317] Call trace:\\n  [  375.704331]  pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\\n  [  375.704411]  pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]\\n  [  375.704487]  pvr_queue_run_job+0x3a4/0x990 [powervr]\\n  [  375.704562]  drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\\n  [  375.704623]  process_one_work+0x520/0x1288\\n  [  375.704658]  worker_thread+0x3f0/0xb3c\\n  [  375.704680]  kthread+0x334/0x3d8\\n  [  375.704706]  ret_from_fork+0x10/0x20\\n  [  375.704736] ---[ end trace 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/imagination/pvr_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"02b0da249c8f78d2bbf9f498bbd371c66142b0af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"943fa73ea0efa335d9c1800fcfac47915de4ff89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"a673171502e87acb5a9e2923f4cf9dce521fd05e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"9cd74f935306cd857f46686975c43383e1d95f94\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/imagination/pvr_queue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/02b0da249c8f78d2bbf9f498bbd371c66142b0af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/943fa73ea0efa335d9c1800fcfac47915de4ff89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cd74f935306cd857f46686975c43383e1d95f94\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a673171502e87acb5a9e2923f4cf9dce521fd05e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-31T11:45:02+00:00",
      "cve": "CVE-2026-68281",
      "id": "CVE-2026-68281",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/imagination: Count paired job fence as dependency in prepare_job()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68281.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.