GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68263 (GCVE-0-2026-68263)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:01
VLAI
Title
drm/imagination: Fix double call to drm_sched_entity_fini()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix double call to drm_sched_entity_fini() Call sequence of double call: pvr_context_destroy   pvr_context_kill_queues     pvr_queue_kill       drm_sched_entity_destroy         drm_sched_entity_fini // here   pvr_context_put     kref_put(..., pvr_context_release)       pvr_context_destroy_queues         pvr_queue_destroy           drm_sched_entity_fini // here Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls drm_sched_entity_flush() + drm_sched_entity_fini(). drm_sched_entity_flush() ensures all pending jobs are completed and drm_sched_entity_fini() ensures no further submission is allowed as per expectation from pvr_context_kill_queues(). Double call to drm_sched_entity_fini() is misuse of the API so keep call only in pvr_context_create() failure path. Stack trace for issue with addition of refcounting for DRM entity stats in commit fd177135f0e6 ("drm/sched: Account entity GPU time"): [ 789.490527] ------------[ cut here ]------------ [ 789.490559] refcount_t: underflow; use-after-free. [ 789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440 [ 789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6 [ 789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT [ 789.490809] Hardware name: Texas Instruments AM625 SK (DT) [ 789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr] [ 789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 789.490876] pc : refcount_warn_saturate+0xf4/0x144 [ 789.490884] lr : refcount_warn_saturate+0xf4/0x144 [ 789.490892] sp : ffff8000822cbcc0 [ 789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000 [ 789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405 [ 789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30 [ 789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768 [ 789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0 [ 789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211 [ 789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30 [ 789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49 [ 789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010 [ 789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000 [ 789.491027] Call trace: [ 789.491032] refcount_warn_saturate+0xf4/0x144 (P) [ 789.491043] drm_sched_entity_fini+0x164/0x18c [gpu_sched] [ 789.491081] pvr_queue_destroy+0x64/0x134 [powervr] [ 789.491110] pvr_context_destroy_queues+0x34/0x64 [powervr] [ 789.491138] pvr_context_release+0x70/0xac [powervr] [ 789.491166] pvr_context_put.part.0+0x5c/0x7c [powervr] [ 789.491193] pvr_context_put+0x14/0x24 [powervr] [ 789.491221] pvr_queue_fence_release_work+0x20/0x38 [powervr] [ 789.491249] process_one_work+0x160/0x4c4 [ 789.491264] worker_thread+0x188/0x310 [ 789.491276] kthread+0x130/0x13c [ 789.491287] ret_from_fork+0x10/0x20 [ 789.491300] ---[ end trace 0000000000000000 ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 9be3f4bd6f514f69c51a8c77ea64fce2729dc7f4 (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < c88fdbf3da26e0179629530cae7768cd3d4ead85 (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < c1136d907fd04ca5c62ba11c1159b5fe65a1760c (git)
Affected: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde , < 4af24c27a39ba147a613a09e10b9e0f7294524c0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_context.c",
            "drivers/gpu/drm/imagination/pvr_queue.c",
            "drivers/gpu/drm/imagination/pvr_queue.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9be3f4bd6f514f69c51a8c77ea64fce2729dc7f4",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "c88fdbf3da26e0179629530cae7768cd3d4ead85",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "c1136d907fd04ca5c62ba11c1159b5fe65a1760c",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            },
            {
              "lessThan": "4af24c27a39ba147a613a09e10b9e0f7294524c0",
              "status": "affected",
              "version": "eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_context.c",
            "drivers/gpu/drm/imagination/pvr_queue.c",
            "drivers/gpu/drm/imagination/pvr_queue.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix double call to drm_sched_entity_fini()\n\nCall sequence of double call:\npvr_context_destroy\n\u2003\u2003pvr_context_kill_queues\n\u2003\u2003\u2003\u2003pvr_queue_kill\n\u2003\u2003\u2003\u2003\u2003\u2003drm_sched_entity_destroy\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003drm_sched_entity_fini // here\n\u2003\u2003pvr_context_put\n\u2003\u2003\u2003\u2003kref_put(..., pvr_context_release)\n\u2003\u2003\u2003\u2003\u2003\u2003pvr_context_destroy_queues\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003pvr_queue_destroy\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003drm_sched_entity_fini // here\n\nCall to drm_sched_entity_destroy() from pvr_context_kill_queues() calls\ndrm_sched_entity_flush() + drm_sched_entity_fini().\ndrm_sched_entity_flush() ensures all pending jobs are completed and\ndrm_sched_entity_fini() ensures no further submission is allowed as\nper expectation from pvr_context_kill_queues(). Double call to\ndrm_sched_entity_fini() is misuse of the API so keep call only in\npvr_context_create() failure path.\n\nStack trace for issue with addition of refcounting for DRM entity\nstats in commit fd177135f0e6 (\"drm/sched: Account entity GPU time\"):\n\n[  789.490527] ------------[ cut here ]------------\n[  789.490559] refcount_t: underflow; use-after-free.\n[  789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440\n[  789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6\n[  789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT\n[  789.490809] Hardware name: Texas Instruments AM625 SK (DT)\n[  789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr]\n[  789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  789.490876] pc : refcount_warn_saturate+0xf4/0x144\n[  789.490884] lr : refcount_warn_saturate+0xf4/0x144\n[  789.490892] sp : ffff8000822cbcc0\n[  789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000\n[  789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405\n[  789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30\n[  789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768\n[  789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0\n[  789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211\n[  789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30\n[  789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49\n[  789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010\n[  789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000\n[  789.491027] Call trace:\n[  789.491032]  refcount_warn_saturate+0xf4/0x144 (P)\n[  789.491043]  drm_sched_entity_fini+0x164/0x18c [gpu_sched]\n[  789.491081]  pvr_queue_destroy+0x64/0x134 [powervr]\n[  789.491110]  pvr_context_destroy_queues+0x34/0x64 [powervr]\n[  789.491138]  pvr_context_release+0x70/0xac [powervr]\n[  789.491166]  pvr_context_put.part.0+0x5c/0x7c [powervr]\n[  789.491193]  pvr_context_put+0x14/0x24 [powervr]\n[  789.491221]  pvr_queue_fence_release_work+0x20/0x38 [powervr]\n[  789.491249]  process_one_work+0x160/0x4c4\n[  789.491264]  worker_thread+0x188/0x310\n[  789.491276]  kthread+0x130/0x13c\n[  789.491287]  ret_from_fork+0x10/0x20\n[  789.491300] ---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the PowerVR DRM render node (/dev/dri/renderD*) via the DRM_IOCTL_PVR_CREATE_CONTEXT / SUBMIT_JOBS / DESTROY_CONTEXT ioctls or by closing the DRM file descriptor, which requires local access to the device.\nAC:L - pvr_context_destroy() unconditionally calls drm_sched_entity_destroy() (fini #1) and pvr_context_release() then calls drm_sched_entity_fini() again, so the extra stats kref put happens deterministically on every context teardown; the attacker also controls job submission, so keeping a job reference alive over the free window is trivially arranged.\nPR:L - All involved ioctls are marked DRM_RENDER_ALLOW, so any unprivileged local user (or sandboxed app on Android/embedded systems) that can open the render node \u2014 the normal configuration for graphics clients \u2014 can drive the path; no capability is required.\nUI:N - The attacker performs the whole sequence itself with open(), a few ioctls and close(); no action by another user or administrator is needed.\nS:U - The corruption stays within kernel memory managed by the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The duplicate drm_sched_entity_stats_put() frees the kref\u0027d drm_sched_entity_stats slab object while in-flight jobs still hold pointers to it, so subsequent scheduler accesses read freed memory that an unprivileged process can reallocate and spray, allowing disclosure of arbitrary kernel data.\nI:H - After the premature free, drm_sched_entity_stats_job_add_gpu_time() takes stats-\u003elock and writes stats-\u003eruntime into reclaimed memory, giving a use-after-free write into an attacker-groomable kmalloc object that can be leveraged for privilege escalation.\nA:H - The refcount underflow triggers a WARNING splat and the resulting use-after-free on the entity stats object corrupts kernel heap state from the scheduler workqueue, readily causing an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:55.726Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9be3f4bd6f514f69c51a8c77ea64fce2729dc7f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c88fdbf3da26e0179629530cae7768cd3d4ead85"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1136d907fd04ca5c62ba11c1159b5fe65a1760c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4af24c27a39ba147a613a09e10b9e0f7294524c0"
        }
      ],
      "title": "drm/imagination: Fix double call to drm_sched_entity_fini()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68263",
    "datePublished": "2026-08-10T12:01:37.571Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-17T05:01:55.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68263",
      "date": "2026-09-11",
      "epss": "0.00125",
      "percentile": "0.02516"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68263\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:15.103\",\"lastModified\":\"2026-08-17T05:18:28.703\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/imagination: Fix double call to drm_sched_entity_fini()\\n\\nCall sequence of double call:\\npvr_context_destroy\\n\u2003\u2003pvr_context_kill_queues\\n\u2003\u2003\u2003\u2003pvr_queue_kill\\n\u2003\u2003\u2003\u2003\u2003\u2003drm_sched_entity_destroy\\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003drm_sched_entity_fini // here\\n\u2003\u2003pvr_context_put\\n\u2003\u2003\u2003\u2003kref_put(..., pvr_context_release)\\n\u2003\u2003\u2003\u2003\u2003\u2003pvr_context_destroy_queues\\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003pvr_queue_destroy\\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003drm_sched_entity_fini // here\\n\\nCall to drm_sched_entity_destroy() from pvr_context_kill_queues() calls\\ndrm_sched_entity_flush() + drm_sched_entity_fini().\\ndrm_sched_entity_flush() ensures all pending jobs are completed and\\ndrm_sched_entity_fini() ensures no further submission is allowed as\\nper expectation from pvr_context_kill_queues(). Double call to\\ndrm_sched_entity_fini() is misuse of the API so keep call only in\\npvr_context_create() failure path.\\n\\nStack trace for issue with addition of refcounting for DRM entity\\nstats in commit fd177135f0e6 (\\\"drm/sched: Account entity GPU time\\\"):\\n\\n[  789.490527] ------------[ cut here ]------------\\n[  789.490559] refcount_t: underflow; use-after-free.\\n[  789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440\\n[  789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6\\n[  789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT\\n[  789.490809] Hardware name: Texas Instruments AM625 SK (DT)\\n[  789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr]\\n[  789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n[  789.490876] pc : refcount_warn_saturate+0xf4/0x144\\n[  789.490884] lr : refcount_warn_saturate+0xf4/0x144\\n[  789.490892] sp : ffff8000822cbcc0\\n[  789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000\\n[  789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405\\n[  789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30\\n[  789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768\\n[  789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0\\n[  789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211\\n[  789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30\\n[  789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49\\n[  789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010\\n[  789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000\\n[  789.491027] Call trace:\\n[  789.491032]  refcount_warn_saturate+0xf4/0x144 (P)\\n[  789.491043]  drm_sched_entity_fini+0x164/0x18c [gpu_sched]\\n[  789.491081]  pvr_queue_destroy+0x64/0x134 [powervr]\\n[  789.491110]  pvr_context_destroy_queues+0x34/0x64 [powervr]\\n[  789.491138]  pvr_context_release+0x70/0xac [powervr]\\n[  789.491166]  pvr_context_put.part.0+0x5c/0x7c [powervr]\\n[  789.491193]  pvr_context_put+0x14/0x24 [powervr]\\n[  789.491221]  pvr_queue_fence_release_work+0x20/0x38 [powervr]\\n[  789.491249]  process_one_work+0x160/0x4c4\\n[  789.491264]  worker_thread+0x188/0x310\\n[  789.491276]  kthread+0x130/0x13c\\n[  789.491287]  ret_from_fork+0x10/0x20\\n[  789.491300] ---[ end trace 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/imagination/pvr_context.c\",\"drivers/gpu/drm/imagination/pvr_queue.c\",\"drivers/gpu/drm/imagination/pvr_queue.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"9be3f4bd6f514f69c51a8c77ea64fce2729dc7f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"c88fdbf3da26e0179629530cae7768cd3d4ead85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"c1136d907fd04ca5c62ba11c1159b5fe65a1760c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde\",\"lessThan\":\"4af24c27a39ba147a613a09e10b9e0f7294524c0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/imagination/pvr_context.c\",\"drivers/gpu/drm/imagination/pvr_queue.c\",\"drivers/gpu/drm/imagination/pvr_queue.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4af24c27a39ba147a613a09e10b9e0f7294524c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9be3f4bd6f514f69c51a8c77ea64fce2729dc7f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1136d907fd04ca5c62ba11c1159b5fe65a1760c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c88fdbf3da26e0179629530cae7768cd3d4ead85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:13:09+00:00",
      "cve": "CVE-2026-68263",
      "id": "CVE-2026-68263",
      "initial_release_date": "2026-08-10T12:01:37.571000+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: drm/imagination use-after-free vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68263.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-14T23:45:27Z",
      "cve": "CVE-2026-68263",
      "id": "CVE-2026-68263",
      "initial_release_date": "2026-08-14T17:15:04Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68263",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68263.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.