SB2026081292 - Improper control of a resource through its lifetime in Linux kernel drm imagination driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68437)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the pvr_queue_prepare_job() and paired fragment job handling in the drm/imagination PowerVR queue logic when processing paired geometry and fragment jobs. A local user can submit crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and job timeouts because the code may check CCCB space in the geometry queue instead of the fragment queue and then fail to write the full command sequence.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/15a9863929206911a08b6f62de9c5da6931dbc9e
• https://git.kernel.org/stable/c/4baf9e70cb756d78dd56419f8baee2978a72d0c3
• https://git.kernel.org/stable/c/4ddf82c18ee4b3d14ec7fa002c4039b46c961abc
• https://git.kernel.org/stable/c/e2c29d51c0f65459ae5bbf7ccc302df4c359c473