{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68281 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68281 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-68281 and fix it if it is affected.\n\nWhat it is: CVE-2026-68281 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-68281 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68281/ (Markdown: https://insights.sbomify.com/CVE-2026-68281/index.md)","id":"CVE-2026-68281","markdown":"https://insights.sbomify.com/CVE-2026-68281/index.md","name":"CVE-2026-68281","record":{"aliases":["BELL-CVE-2026-68281","DEBIAN-CVE-2026-68281","GHSA-xmch-cvc7-cmxw","UBUNTU-CVE-2026-68281"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel GPU driver","requires_auth":"none","summary":"A race condition in the Imagination GPU driver can cause job timeouts and kernel warnings, leading to denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Count paired job fence as dependency in prepare_job()\n\nThe DRM scheduler's prepare_job() callback counts the remaining\nnon-signaled native dependencies for a job, preventing job submission\nuntil those (plus job data and fence update) can fit in the job queue's\nCCCB.\n\nThis means checking which dependencies can be waited upon in the\nfirmware, i.e. whether they are backed by a UFO object, i.e. whether\ntheir drm_sched_fence::parent has been assigned to a\npvr_queue_fence::base fence. That happens when the job owning the fence\nis submitted to the firmware.\n\nPaired geometry and fragment jobs are submitted at the same time, which\nmeans the dependency between them can't be checked this way before\nsubmission.\n\nUpdate job_count_remaining_native_deps() to take into account the\ndependency between paired jobs.\n\nThis fixes cases where prepare_job() underestimated the space left in\nan almost full fragment CCCB, wrongly unblocking run_job(), which then\nreturned early without writing the full sequence of commands to the\nCCCB.\n\nThe above lead to kernel warnings such as the following and potentially\njob timeouts (depending on waiters on the missing commands):\n\n  [  375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47\n  [  375.703160] Modules linked in:\n  [  375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G        W           7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT\n  [  375.703613] Tainted: [W]=WARN\n  [  375.703627] Hardware name: Texas Instruments AM625 SK (DT)\n  [  375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched]\n  [  375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  [  375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr]\n  [  375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]\n  [  375.703921] sp : ffff800084a97650\n  [  375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000\n  [  375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000\n  [  375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008\n  [  375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000\n  [  375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000\n  [  375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  [  375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3\n  [  375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008\n  [  375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000\n  [  375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f\n  [  375.704317] Call trace:\n  [  375.704331]  pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P)\n  [  375.704411]  pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr]\n  [  375.704487]  pvr_queue_run_job+0x3a4/0x990 [powervr]\n  [  375.704562]  drm_sched_run_job_work+0x580/0xd48 [gpu_sched]\n  [  375.704623]  process_one_work+0x520/0x1288\n  [  375.704658]  worker_thread+0x3f0/0xb3c\n  [  375.704680]  kthread+0x334/0x3d8\n  [  375.704706]  ret_from_fork+0x10/0x20\n  [  375.704736] ---[ end trace 0000000000000000 ]---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/imagination: Count paired job fence as dependency in prepare_job()","id":"CVE-2026-68281","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()","id":"CVE-2026-68282"},"packages":[],"prev":{"headline":"drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()","id":"CVE-2026-68280"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A race condition in the Imagination GPU driver can cause job timeouts and kernel warnings, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-68281/"}