CVE-2026-68437

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fit paired fragment job in the correct CCCB

For geometry jobs with a paired fragment job, at the moment, the

DRM scheduler's prepare_job() callback:

- checks for internal (driver) dependencies for the geometry job;

- calls into pvr_queue_get_paired_frag_job_dep() to check for external

dependencies for the fragment job (the two jobs are submitted together

but the common scheduler code doesn't know about it, so this needs to

be done at this point in time);

- calls into the prepare_job() callback again, but for the fragment job,

to check its internal dependencies as well, passing the fragment job's

drm_sched_job and the geometry job's drm_sched_entity / pvr_queue.

The problem with the last step is that pvr_queue_prepare_job() doesn't

always take the mismatched fragment job and geometry queue into account,

in particular when checking whether there is space for the fragment

command to be submi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References