drm/imagination: Fit paired fragment job in the correct CCCB
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback: - checks for internal (driver) dependencies for the geometry job; - calls into pvr_queue_get_paired_frag_job_dep() to check for external dependencies for the fragment job (the two jobs are submitted together but the common scheduler code doesn't know about it, so this needs to be done at this point in time); - calls into the prepare_job() callback again, but for the fragment job, to check its internal dependencies as well, passing the fragment job's drm_sched_job and the geometry job's drm_sched_entity / pvr_queue. The problem with the last step is that pvr_queue_prepare_job() doesn't always take the mismatched fragment job and geometry queue into account, in particular when checking whether there is space for the fragment command to be submitted, so the code ends up checking for space in the geometry (i.e. wrong) CCCB. The rest of the nested prepare_job() callback happens to work fine at the moment as the other internal dependencies are not relevant for a paired fragment job. Move the initialisation of a paired fragment job's done fence and CCCB fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct queue from the fragment job itself. This fixes cases where prepare_job() wrongly assumed that there was enough space for a paired fragm
CVE-2026-68437
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-68437
Kernel
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.12.101
Source reference:
/affected/1/ranges6.18.42Source reference:
/affected/1/ranges7.1.6Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde"
},
{
"fixed": "15a9863929206911a08b6f62de9c5da6931dbc9e"
},
{
"fixed": "e2c29d51c0f65459ae5bbf7ccc302df4c359c473"
},
{
"fixed": "4ddf82c18ee4b3d14ec7fa002c4039b46c961abc"
},
{
"fixed": "4baf9e70cb756d78dd56419f8baee2978a72d0c3"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68437.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.8.0"
},
{
"fixed": "6.12.101"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.42"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68437.json"
}
}
]- Related CVEs
- CVE-2026-68437
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #50660 · Revision 1
- Added to Heist Feed
- Publisher date