CVE-2026-68437 — drm/imagination: Fit paired fragment job in the correct CCCB

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fit paired fragment job in the correct CCCB

For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback:

- checks for internal (driver) dependencies for the geometry job; - calls into pvr_queue_get_paired_frag_job_dep() to check for external dependencies for the fragment job (the two jobs are submitted together but the common scheduler code doesn't know about it, so this needs to be done at this point in time); - calls into the prepare_job() callback again, but for the fragment job, to check its internal dependencies as well, passing the fragment job's drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.

The problem with the last step is that pvr_queue_prepare_job() doesn't always take the mismatched fragment job and geometry queue into account, in particular when checking whether there is space for the fragment command to be submitted, so the code ends up checking for space in the geometry (i.e. wrong) CCCB. The rest of the nested prepare_job() callback happens to work fine at the moment as the other internal dependencies are not relevant for a paired fragment job.

Move the initialisation of a paired fragment job's done fence and CCCB fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct queue from the fragment job itself.

This fixes cases where prepare_job() wrongly assumed that there was enough space f…

Most recent entries from all

CVE-2026-68437 — drm/imagination: Fit paired fragment job in the correct CCCB