Към съдържанието
Търсене

CVE-2026-68437: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback: - checks for internal (driver) dependencies for the geometry job; - calls into pvr_queue_get_paired_frag_job_dep() to check for external dependencies for the fragment job (the two jobs are submitted together but the common scheduler code doesn't know about it, so this needs to be done at this point in time); - calls into the prepare_job() callback again, but for the fragment job, to check its internal dependencies as well, passing the fragment job's drm_sched_job and the geometry job's drm_sched_entity / pvr_queue. The problem with the last step is that pvr_queue_prepare_job() doesn't always take the mismatched fragment job and geometry queue into account, in particular when checking whether there is space for the fragment command to be submitted, so the code ends up checking for space in the geometry (i.e. wrong) CCCB. The rest of the nested prepare_job() callback happens to work fine at the moment as the other internal dependencies are not relevant for a paired fragment job. Move the initialisation of a paired fragment job's done fence and CCCB fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct queue from the fragment job itself. This fixes cases where prepare_job() wrongly assumed that there was enough space for a paired fragment job in its own CCCB, unblocking run_job(), which then returned early without writing the full sequence of commands to the CCCB. The above lead to kernel warnings such as the following and potentially job timeouts (depending on waiters on the missing commands): [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63 [ 552.421230] Modules linked in: [ 552.421592] CPU: 2 UID

    Засегнати продукти

    • Linux Linux: eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde преди 15a9863929206911a08b6f62de9c5da6931dbc9e; eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde преди e2c29d51c0f65459ae5bbf7ccc302df4c359c473; eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde преди 4ddf82c18ee4b3d14ec7fa002c4039b46c961abc; eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde преди 4baf9e70cb756d78dd56419f8baee2978a72d0c3
    • Linux Linux: 6.8; преди 6.8; 6.12.101 до 6.12.*; 6.18.42 до 6.18.*; 7.1.6 до 7.1.*; от 7.2 нататък

    История

    • 12 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-68437: Linux | freedomonline.bg