Skip to content
OpenAdvisories
High · 7.8 CVE-2026-68263 EUVD-2026-55364GHSA-x35m-7ch7-75hq

drm/imagination: Fix double call to drm_sched_entity_fini()

Published Aug 10, 2026 · Updated Aug 17, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-6.12 Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-7.0 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fix double call to drm_sched_entity_fini()

Call sequence of double call:
pvr_context_destroy
  pvr_context_kill_queues
    pvr_queue_kill
      drm_sched_entity_destroy
        drm_sched_entity_fini // here
  pvr_context_put
    kref_put(..., pvr_context_release)
      pvr_context_destroy_queues
        pvr_queue_destroy
          drm_sched_entity_fini // here

Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls
drm_sched_entity_flush() + drm_sched_entity_fini().
drm_sched_entity_flush() ensures all pending jobs are completed and
drm_sched_entity_fini() ensures no further submission is allowed as
per expectation from pvr_context_kill_queues(). Double call to
drm_sched_entity_fini() is misuse of the API so keep call only in
pvr_context_create() failure path.

Stack trace for issue with addition of refcounting for DRM entity
stats in commit fd177135f0e6 ("drm/sched: Account entity GPU time"):

[ 789.490527] ------------[ cut here ]------------
[ 789.490559] refcount_t: underflow; use-after-free.
[ 789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440
[ 789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6
[ 789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT
[ 789.490809] Hardware name: Texas Instruments AM625 SK (DT)
[ 789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr]
[ 789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 789.490876] pc : refcount_warn_saturate+0xf4/0x144
[ 789.490884] lr : refcount_warn_saturate+0xf4/0x144
[ 789.490892] sp : ffff8000822cbcc0
[ 789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000
[ 789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405
[ 789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30
[ 789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768
[ 789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0
[ 789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211
[ 789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30
[ 789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49
[ 789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010
[ 789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000
[ 789.491027] Call trace:
[ 789.491032] refcount_warn_saturate+0xf4/0x144 (P)
[ 789.491043] drm_sched_entity_fini+0x164/0x18c [gpu_sched]
[ 789.491081] pvr_queue_destroy+0x64/0x134 [powervr]
[ 789.491110] pvr_context_destroy_queues+0x34/0x64 [powervr]
[ 789.491138] pvr_context_release+0x70/0xac [powervr]
[ 789.491166] pvr_context_put.part.0+0x5c/0x7c [powervr]
[ 789.491193] pvr_context_put+0x14/0x24 [powervr]
[ 789.491221] pvr_queue_fence_release_work+0x20/0x38 [powervr]
[ 789.491249] process_one_work+0x160/0x4c4
[ 789.491264] worker_thread+0x188/0x310
[ 789.491276] kthread+0x130/0x13c
[ 789.491287] ret_from_fork+0x10/0x20
[ 789.491300] ---[ end trace 0000000000000000 ]---

Affected products

VendorProductAffectedFixed
Linux Linux 6.8 6.12.101

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.1.6-1 —
Debian 13 linux 6.12.101-1 —
Debian 12 linux-6.12 6.12.101-1~deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1033.38 —
Ubuntu 26.04 LTS linux 7.0.0-38.38 USN-8887-1
Ubuntu 26.04 LTS linux-aws +1 7.0.0-1014.14 USN-8887-1
Ubuntu 26.04 LTS linux-azure 7.0.0-1017.17 USN-8888-1
Ubuntu 26.04 LTS linux-azure-fde 7.0.0-1016.16 USN-8888-1
Ubuntu 26.04 LTS linux-gke 7.0.0-1008.9 USN-8887-1
Ubuntu 26.04 LTS linux-ibm +1 7.0.0-1015.15 USN-8889-1, USN-8887-1
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1025.26 USN-9043-1
Ubuntu 26.04 LTS linux-nvidia-bos 7.0.0-2022.23 USN-9003-1
Ubuntu 26.04 LTS linux-oracle 7.0.0-1013.13 USN-8887-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1023.23 USN-9021-1
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-38.38.1 USN-8887-1
Ubuntu 24.04 LTS linux 6.8.0-147.147 USN-8917-1
Ubuntu 24.04 LTS linux-aws +1 6.8.0-1067.70 USN-9024-1, USN-8917-1
Ubuntu 24.04 LTS linux-aws-7.0 +1 7.0.0-1014.14~24.04.1 USN-8887-3, USN-8887-2
Ubuntu 24.04 LTS linux-azure-7.0 7.0.0-1017.17~24.04.1 USN-8888-2
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1069.76 USN-8918-1
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1016.16~24.04.1 USN-8888-2
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1071.79 USN-8918-1, USN-8917-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1066.74 USN-8917-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1052.56 USN-8917-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-38.38~24.04.4 USN-8887-3
Ubuntu 24.04 LTS linux-ibm 6.8.0-1067.68 USN-8917-1
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-147.147.1 USN-8917-1
Ubuntu 24.04 LTS linux-nvidia-7.0 7.0.0-1024.25~24.04.1 USN-9003-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1067.70.1 USN-9040-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1036.39 USN-8886-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1064.67 USN-8917-1
Ubuntu 24.04 LTS linux-oracle-7.0 7.0.0-1013.13~24.04.1 USN-8887-3
Ubuntu 24.04 LTS linux-raspi 6.8.0-1068.72 USN-9025-1
Ubuntu 24.04 LTS linux-riscv +29 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-38.38.1~24.04.1 —
Ubuntu 24.04 LTS linux-vmware 6.8.0-1008.8 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1069.74~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1073.82~22.04.1 USN-9026-1
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1071.78~22.04.1 USN-9026-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1073.81~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-149.149~22.04.1 USN-9066-1
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1069.70~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-149.149.1~22.04.1 USN-9024-1
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1067.71~22.04.1 USN-9025-1
Ubuntu 22.04 LTS linux-riscv +33 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2056.58 USN-9025-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1062.63 USN-8917-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1064.65~22.04.1 USN-9024-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1067.70+fips1 USN-8917-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-147.147+fips1 USN-8917-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips +1 6.8.0-1071.79+fips1 USN-8918-1, USN-8917-1
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +7 6.4.0-150700.53.81.1 SUSE-SU-2026:4254-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.81.1.150700.17.45.1 SUSE-SU-2026:4254-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1, SUSE-SU-2026:23897-1
SLES 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23887-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.38.1 SUSE-SU-2026:23887-1, SUSE-SU-2026:23881-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.81.1 SUSE-SU-2026:4254-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_20 1-150700.1.3.1 SUSE-SU-2026:4120-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_21 1-150700.15.3.1 SUSE-SU-2026:4254-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.75.1 SUSE-SU-2026:4120-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.22 openSUSE-SU-2026:21910-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.38.1 openSUSE-SU-2026:21910-1

Advisories 25

References