{"api_version":"1","generated_at":"2026-08-14T13:08:04+00:00","cve":"CVE-2026-68437","urls":{"html":"https://cve.report/CVE-2026-68437","api":"https://cve.report/api/cve/CVE-2026-68437.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68437","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68437"},"summary":{"title":"drm/imagination: Fit paired fragment job in the correct CCCB","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fit paired fragment job in the correct CCCB\n\nFor geometry jobs with a paired fragment job, at the moment, the\nDRM scheduler's prepare_job() callback:\n\n- checks for internal (driver) dependencies for the geometry job;\n- calls into pvr_queue_get_paired_frag_job_dep() to check for external\n  dependencies for the fragment job (the two jobs are submitted together\n  but the common scheduler code doesn't know about it, so this needs to\n  be done at this point in time);\n- calls into the prepare_job() callback again, but for the fragment job,\n  to check its internal dependencies as well, passing the fragment job's\n  drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.\n\nThe problem with the last step is that pvr_queue_prepare_job() doesn't\nalways take the mismatched fragment job and geometry queue into account,\nin particular when checking whether there is space for the fragment\ncommand to be submitted, so the code ends up checking for space in the\ngeometry (i.e. wrong) CCCB.\nThe rest of the nested prepare_job() callback happens to work fine at\nthe moment as the other internal dependencies are not relevant for a\npaired fragment job.\n\nMove the initialisation of a paired fragment job's done fence and CCCB\nfence to pvr_queue_get_paired_frag_job_dep(), inferring the correct\nqueue from the fragment job itself.\n\nThis fixes cases where prepare_job() wrongly assumed that there was\nenough space for a paired fragment job in its own CCCB, unblocking\nrun_job(), which then returned early without writing the full sequence\nof commands to the CCCB.\n\nThe above lead to kernel warnings such as the following and potentially\njob timeouts (depending on waiters on the missing commands):\n\n  [  552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63\n  [  552.421230] Modules linked in:\n  [  552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G        W           7.0.0-rc2-gc5d053e4dccb #39 PREEMPT\n  [  552.421625] Tainted: [W]=WARN\n  [  552.421637] Hardware name: Texas Instruments AM625 SK (DT)\n  [  552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\n  [  552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\n  [  552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n  [  552.421923] sp : ffff800084c47650\n  [  552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000\n  [  552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000\n  [  552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008\n  [  552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000\n  [  552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\n  [  552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  [  552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\n  [  552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008\n  [  552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000\n  [  552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\n  [  552.422316] Call trace:\n  [  552.422330]  pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\n  [  552.422411]  pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n  [  552.422486]  pvr_queue_run_job+0x3a4/0x990 [powervr]\n  [  552.422562]  drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\n  [  552.422623]  process_one_work+0x520/0x1288\n  [  552.422657]  worker_thread+0x3f0/0xb3c\n  [  552.422679]  kthread+0x334/0x3d8\n  [  552.422706]  ret_from_fork+0x10/0x20","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-12 00:17:43","updated_at":"2026-08-12 00:17:43"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/4baf9e70cb756d78dd56419f8baee2978a72d0c3","name":"https://git.kernel.org/stable/c/4baf9e70cb756d78dd56419f8baee2978a72d0c3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/15a9863929206911a08b6f62de9c5da6931dbc9e","name":"https://git.kernel.org/stable/c/15a9863929206911a08b6f62de9c5da6931dbc9e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4ddf82c18ee4b3d14ec7fa002c4039b46c961abc","name":"https://git.kernel.org/stable/c/4ddf82c18ee4b3d14ec7fa002c4039b46c961abc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e2c29d51c0f65459ae5bbf7ccc302df4c359c473","name":"https://git.kernel.org/stable/c/e2c29d51c0f65459ae5bbf7ccc302df4c359c473","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68437","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68437","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde 15a9863929206911a08b6f62de9c5da6931dbc9e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde e2c29d51c0f65459ae5bbf7ccc302df4c359c473 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde 4ddf82c18ee4b3d14ec7fa002c4039b46c961abc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde 4baf9e70cb756d78dd56419f8baee2978a72d0c3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68437","cve":"CVE-2026-68437","epss":"0.001570000","percentile":"0.053120000","score_date":"2026-08-12","updated_at":"2026-08-13 00:04:46"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/imagination/pvr_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"15a9863929206911a08b6f62de9c5da6931dbc9e","status":"affected","version":"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde","versionType":"git"},{"lessThan":"e2c29d51c0f65459ae5bbf7ccc302df4c359c473","status":"affected","version":"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde","versionType":"git"},{"lessThan":"4ddf82c18ee4b3d14ec7fa002c4039b46c961abc","status":"affected","version":"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde","versionType":"git"},{"lessThan":"4baf9e70cb756d78dd56419f8baee2978a72d0c3","status":"affected","version":"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/imagination/pvr_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"6.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fit paired fragment job in the correct CCCB\n\nFor geometry jobs with a paired fragment job, at the moment, the\nDRM scheduler's prepare_job() callback:\n\n- checks for internal (driver) dependencies for the geometry job;\n- calls into pvr_queue_get_paired_frag_job_dep() to check for external\n  dependencies for the fragment job (the two jobs are submitted together\n  but the common scheduler code doesn't know about it, so this needs to\n  be done at this point in time);\n- calls into the prepare_job() callback again, but for the fragment job,\n  to check its internal dependencies as well, passing the fragment job's\n  drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.\n\nThe problem with the last step is that pvr_queue_prepare_job() doesn't\nalways take the mismatched fragment job and geometry queue into account,\nin particular when checking whether there is space for the fragment\ncommand to be submitted, so the code ends up checking for space in the\ngeometry (i.e. wrong) CCCB.\nThe rest of the nested prepare_job() callback happens to work fine at\nthe moment as the other internal dependencies are not relevant for a\npaired fragment job.\n\nMove the initialisation of a paired fragment job's done fence and CCCB\nfence to pvr_queue_get_paired_frag_job_dep(), inferring the correct\nqueue from the fragment job itself.\n\nThis fixes cases where prepare_job() wrongly assumed that there was\nenough space for a paired fragment job in its own CCCB, unblocking\nrun_job(), which then returned early without writing the full sequence\nof commands to the CCCB.\n\nThe above lead to kernel warnings such as the following and potentially\njob timeouts (depending on waiters on the missing commands):\n\n  [  552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63\n  [  552.421230] Modules linked in:\n  [  552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G        W           7.0.0-rc2-gc5d053e4dccb #39 PREEMPT\n  [  552.421625] Tainted: [W]=WARN\n  [  552.421637] Hardware name: Texas Instruments AM625 SK (DT)\n  [  552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\n  [  552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\n  [  552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n  [  552.421923] sp : ffff800084c47650\n  [  552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000\n  [  552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000\n  [  552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008\n  [  552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000\n  [  552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\n  [  552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  [  552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\n  [  552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008\n  [  552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000\n  [  552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\n  [  552.422316] Call trace:\n  [  552.422330]  pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\n  [  552.422411]  pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n  [  552.422486]  pvr_queue_run_job+0x3a4/0x990 [powervr]\n  [  552.422562]  drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\n  [  552.422623]  process_one_work+0x520/0x1288\n  [  552.422657]  worker_thread+0x3f0/0xb3c\n  [  552.422679]  kthread+0x334/0x3d8\n  [  552.422706]  ret_from_fork+0x10/0x20"}],"providerMetadata":{"dateUpdated":"2026-08-12T00:07:25.745Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/15a9863929206911a08b6f62de9c5da6931dbc9e"},{"url":"https://git.kernel.org/stable/c/e2c29d51c0f65459ae5bbf7ccc302df4c359c473"},{"url":"https://git.kernel.org/stable/c/4ddf82c18ee4b3d14ec7fa002c4039b46c961abc"},{"url":"https://git.kernel.org/stable/c/4baf9e70cb756d78dd56419f8baee2978a72d0c3"}],"title":"drm/imagination: Fit paired fragment job in the correct CCCB","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68437","datePublished":"2026-08-12T00:07:25.745Z","dateReserved":"2026-07-30T09:28:09.394Z","dateUpdated":"2026-08-12T00:07:25.745Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-12 00:17:43","lastModifiedDate":"2026-08-12 00:17:43","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68437","Ordinal":"1","Title":"drm/imagination: Fit paired fragment job in the correct CCCB","CVE":"CVE-2026-68437","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68437","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fit paired fragment job in the correct CCCB\n\nFor geometry jobs with a paired fragment job, at the moment, the\nDRM scheduler's prepare_job() callback:\n\n- checks for internal (driver) dependencies for the geometry job;\n- calls into pvr_queue_get_paired_frag_job_dep() to check for external\n  dependencies for the fragment job (the two jobs are submitted together\n  but the common scheduler code doesn't know about it, so this needs to\n  be done at this point in time);\n- calls into the prepare_job() callback again, but for the fragment job,\n  to check its internal dependencies as well, passing the fragment job's\n  drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.\n\nThe problem with the last step is that pvr_queue_prepare_job() doesn't\nalways take the mismatched fragment job and geometry queue into account,\nin particular when checking whether there is space for the fragment\ncommand to be submitted, so the code ends up checking for space in the\ngeometry (i.e. wrong) CCCB.\nThe rest of the nested prepare_job() callback happens to work fine at\nthe moment as the other internal dependencies are not relevant for a\npaired fragment job.\n\nMove the initialisation of a paired fragment job's done fence and CCCB\nfence to pvr_queue_get_paired_frag_job_dep(), inferring the correct\nqueue from the fragment job itself.\n\nThis fixes cases where prepare_job() wrongly assumed that there was\nenough space for a paired fragment job in its own CCCB, unblocking\nrun_job(), which then returned early without writing the full sequence\nof commands to the CCCB.\n\nThe above lead to kernel warnings such as the following and potentially\njob timeouts (depending on waiters on the missing commands):\n\n  [  552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63\n  [  552.421230] Modules linked in:\n  [  552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G        W           7.0.0-rc2-gc5d053e4dccb #39 PREEMPT\n  [  552.421625] Tainted: [W]=WARN\n  [  552.421637] Hardware name: Texas Instruments AM625 SK (DT)\n  [  552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\n  [  552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\n  [  552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n  [  552.421923] sp : ffff800084c47650\n  [  552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000\n  [  552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000\n  [  552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008\n  [  552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000\n  [  552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\n  [  552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  [  552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\n  [  552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008\n  [  552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000\n  [  552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\n  [  552.422316] Call trace:\n  [  552.422330]  pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\n  [  552.422411]  pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr]\n  [  552.422486]  pvr_queue_run_job+0x3a4/0x990 [powervr]\n  [  552.422562]  drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\n  [  552.422623]  process_one_work+0x520/0x1288\n  [  552.422657]  worker_thread+0x3f0/0xb3c\n  [  552.422679]  kthread+0x334/0x3d8\n  [  552.422706]  ret_from_fork+0x10/0x20","Type":"Description","Title":"drm/imagination: Fit paired fragment job in the correct CCCB"}]}}}