CVE-2026-68281

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Count paired job fence as dependency in prepare_job()

The DRM scheduler's prepare_job() callback counts the remaining

non-signaled native dependencies for a job, preventing job submission

until those (plus job data and fence update) can fit in the job queue's

CCCB.

This means checking which dependencies can be waited upon in the

firmware, i.e. whether they are backed by a UFO object, i.e. whether

their drm_sched_fence::parent has been assigned to a

pvr_queue_fence::base fence. That happens when the job owning the fence

is submitted to the firmware.

Paired geometry and fragment jobs are submitted at the same time, which

means the dependency between them can't be checked this way before

submission.

Update job_count_remaining_native_deps() to take into account the

dependency between paired jobs.

This fixes cases where prepare_job() underestimated the space left in

an almost full fragment CCCB, wrong

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References