Skip to main content

Linux Kernel EUVDEUVD-2026-55364

| CVE-2026-68263 HIGH
2026-08-10 Linux GHSA-x35m-7ch7-75hq
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local exploitation requiring low-privilege GPU device access; AC:L because the double-free is deterministically triggered; C/I/A all High due to kernel use-after-free potential.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:22 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:01 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fix double call to drm_sched_entity_fini()

Call sequence of double call: pvr_context_destroy pvr_context_kill_queues pvr_queue_kill drm_sched_entity_destroy drm_sched_entity_fini // here pvr_context_put kref_put(..., pvr_context_release) pvr_context_destroy_queues pvr_queue_destroy drm_sched_entity_fini // here

Call to drm_sched_entity_destroy() from pvr_context_kill_queues() calls drm_sched_entity_flush() + drm_sched_entity_fini(). drm_sched_entity_flush() ensures all pending jobs are completed and drm_sched_entity_fini() ensures no further submission is allowed as per expectation from pvr_context_kill_queues(). Double call to drm_sched_entity_fini() is misuse of the API so keep call only in pvr_context_create() failure path.

Stack trace for issue with addition of refcounting for DRM entity stats in commit fd177135f0e6 ("drm/sched: Account entity GPU time"):

[ 789.490527] ------------[ cut here ]------------ [ 789.490559] refcount_t: underflow; use-after-free. [ 789.490657] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144, CPU#0: kworker/u16:1/440 [ 789.490695] Modules linked in: powervr drm_gpuvm drm_exec gpu_sched drm_shmem_helper xhci_plat_hcd xhci_hcd dwc3 usbcore usb_common snd_soc_simple_card snd_soc_simple_card_utils sa2ul sha512 sha256 dwc3_am62 sha1 authenc rti_wdt libsha512 at24 sch_fq_codel fuse dm_mod ipv6 [ 789.490798] CPU: 0 UID: 0 PID: 440 Comm: kworker/u16:1 Not tainted 7.0.0-rc7-02049-g5e2c0700091b #22 PREEMPT [ 789.490809] Hardware name: Texas Instruments AM625 SK (DT) [ 789.490815] Workqueue: powervr-sched pvr_queue_fence_release_work [powervr] [ 789.490868] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 789.490876] pc : refcount_warn_saturate+0xf4/0x144 [ 789.490884] lr : refcount_warn_saturate+0xf4/0x144 [ 789.490892] sp : ffff8000822cbcc0 [ 789.490895] x29: ffff8000822cbcc0 x28: 0000000000000000 x27: 0000000000000000 [ 789.490909] x26: 0000000000000000 x25: ffff800081b1e338 x24: ffff000004541405 [ 789.490922] x23: ffff000004bea950 x22: ffff00000042e400 x21: ffff000007123e30 [ 789.490935] x20: ffff000007123000 x19: ffff000007a80d50 x18: fffffffffffe7768 [ 789.490948] x17: 74736574202c6e6f x16: 697461746e656d65 x15: ffff800081b269f0 [ 789.490962] x14: 0000000000000030 x13: ffff800081b26a70 x12: 0000000000000211 [ 789.490975] x11: 00000000000000c0 x10: 0000000000000b50 x9 : ffff8000822cbb30 [ 789.490988] x8 : ffff0000014e7bb0 x7 : ffff00007725e780 x6 : 0000000372a05f49 [ 789.491001] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000010 [ 789.491013] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000014e7000 [ 789.491027] Call trace: [ 789.491032] refcount_warn_saturate+0xf4/0x144 (P) [ 789.491043] drm_sched_entity_fini+0x164/0x18c [gpu_sched] [ 789.491081] pvr_queue_destroy+0x64/0x134 [powervr] [ 789.491110] pvr_context_destroy_queues+0x34/0x64 [powervr] [ 789.491138] pvr_context_release+0x70/0xac [powervr] [ 789.491166] pvr_context_put.part.0+0x5c/0x7c [powervr] [ 789.491193] pvr_context_put+0x14/0x24 [powervr] [ 789.491221] pvr_queue_fence_release_work+0x20/0x38 [powervr] [ 789.491249] process_one_work+0x160/0x4c4 [ 789.491264] worker_thread+0x188/0x310 [ 789.491276] kthread+0x130/0x13c [ 789.491287] ret_from_fork+0x10/0x20 [ 789.491300] ---[ end trace 0000000000000000 ]---

AnalysisAI

Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.

Technical ContextAI

The vulnerability resides in the drm/imagination subsystem (powervr kernel module), which manages GPU scheduling for Imagination Technologies PowerVR GPUs via the DRM GPU scheduler (gpu_sched module). The drm_sched_entity_fini() API is a one-shot finalizer: it marks a scheduling entity as ineligible for further submission and releases associated resources. The double invocation arises because pvr_context_destroy calls pvr_context_kill_queues, which calls drm_sched_entity_destroy (itself a wrapper calling drm_sched_entity_flush + drm_sched_entity_fini), and then separately calls pvr_context_put, which eventually reaches pvr_queue_destroy and calls drm_sched_entity_fini a second time. The refcount underflow was made observable by commit fd177135f0e6 ('drm/sched: Account entity GPU time'), which introduced reference-counted statistics on scheduler entities. The CWE classification is not formally assigned, but the root cause maps to CWE-415 (Double Free) and CWE-911 (Improper Update of Reference Count). Affected CPE: cpe:2.3:a:linux:linux:* across kernels from commit eaf01ee5ba28b97f96a3d3eec4c5fbfb37ee4cde onward through the unfixed stable series.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.101 or 7.1.6 for stable production systems, or 7.2-rc2 for testing branches. Patch commits are confirmed at kernel.org stable tree (see references above). For embedded Linux distributions (e.g., Yocto-based builds targeting TI AM625), apply the relevant stable kernel commit to your downstream tree and rebuild. If immediate kernel upgrade is not feasible, a targeted workaround is to prevent loading of the powervr kernel module on systems that do not require Imagination GPU acceleration: add 'blacklist powervr' to /etc/modprobe.d/ and rebuild initramfs. This eliminates the vulnerable code path entirely but disables PowerVR GPU support, which may be acceptable on systems using only the CPU. Note that restricting access to /dev/dri/ nodes via udev rules limits the pool of users who can trigger GPU context creation but does not eliminate the underlying double-free if any privileged process performs context teardown.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-55364 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy