CVE-2026-68263

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fix double call to drm_sched_entity_fini()

Call sequence of double call:

pvr_context_destroy

  pvr_context_kill_queues

    pvr_queue_kill

      drm_sched_entity_destroy

        drm_sched_entity_fini // here

  pvr_context_put

    kref_put(..., pvr_context_release)

      pvr_context_destroy_queues

        pvr_queue_destroy

          drm_sched_entity_fini // here

Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls

drm_sched_entity_flush() + drm_sched_entity_fini().

drm_sched_entity_flush() ensures all pending jobs are completed and

drm_sched_entity_fini() ensures no further submission is allowed as

per expectation from pvr_context_kill_queues(). Double call to

drm_sched_entity_fini() is misuse of the API so keep call only in

pvr_context_create() failure path.

Stack trace for issue with addition of refcounting for DRM entity

stats in commit fd177135f0e6 ("drm/sched: Account entity G

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References