CVE-2026-68281 — drm/imagination: Count paired job fence as dependency in prepare_job()

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Count paired job fence as dependency in prepare_job()

The DRM scheduler's prepare_job() callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those (plus job data and fence update) can fit in the job queue's CCCB.

This means checking which dependencies can be waited upon in the firmware, i.e. whether they are backed by a UFO object, i.e. whether their drm_sched_fence::parent has been assigned to a pvr_queue_fence::base fence. That happens when the job owning the fence is submitted to the firmware.

Paired geometry and fragment jobs are submitted at the same time, which means the dependency between them can't be checked this way before submission.

Update job_count_remaining_native_deps() to take into account the dependency between paired jobs.

This fixes cases where prepare_job() underestimated the space left in an almost full fragment CCCB, wrongly unblocking run_job(), which then returned early without writing the full sequence of commands to the CCCB.

The above lead to kernel warnings such as the following and potentially job timeouts (depending on waiters on the missing commands):

[ 375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47 [ 375.703160] Modules linked in: [ 375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Taint…

Most recent entries from all

CVE-2026-68281 — drm/imagination: Count paired job fence as dependency in prepare_job()