CVE-2026-68263: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68263 Overview

CVE-2026-68263 is a use-after-free vulnerability in the Linux kernel's drm/imagination (PowerVR) GPU driver. The flaw stems from a double call to drm_sched_entity_fini() during context teardown, causing reference-count underflow on DRM scheduler entity statistics. A local, low-privileged user can trigger the condition by exercising the PowerVR context lifecycle, leading to kernel memory corruption. The bug was introduced by commit fd177135f0e6 ("drm/sched: Account entity GPU time"), which added refcounting to DRM entity stats and made the pre-existing duplicate finalization path observable as a refcount_t: underflow; use-after-free warning.

Critical Impact
Local attackers with access to the PowerVR DRM device can trigger kernel memory corruption, resulting in denial of service or potential local privilege escalation on affected systems.

Affected Products

Linux kernel builds including the drm/imagination (PowerVR) driver
Systems using Imagination Technologies GPUs, such as Texas Instruments AM625 platforms
Kernel versions containing commit fd177135f0e6 prior to the fix

Discovery Timeline

2026-08-10 - CVE-2026-68263 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68263

Vulnerability Analysis

The vulnerability resides in the PowerVR GPU driver's context destruction path. When pvr_context_destroy() executes, it invokes pvr_context_kill_queues(), which calls pvr_queue_kill() and subsequently drm_sched_entity_destroy(). That function performs both drm_sched_entity_flush() (waiting for pending jobs) and drm_sched_entity_fini() (blocking further submissions). The destruction path then continues through pvr_context_put() and kref_put(), which triggers pvr_context_release() and pvr_context_destroy_queues(). That second path calls pvr_queue_destroy(), which invokes drm_sched_entity_fini() a second time on the same entity.

Root Cause

The root cause is redundant finalization of a DRM scheduler entity. The drm_sched_entity_fini() API is not designed to be idempotent. Calling it twice decrements internal reference counters below zero, producing a refcount_t underflow. After commit fd177135f0e6 added refcounting to entity GPU-time statistics, the second drm_sched_entity_fini() call dereferences already-released state, matching a classic use-after-free pattern [CWE-416].

Attack Vector

Exploitation requires local access with the ability to open the PowerVR DRM device and create or destroy GPU contexts. No user interaction is required. An attacker triggers repeated context creation and teardown to exercise the double-fini path. The resulting refcount underflow can lead to freed scheduler entity memory being accessed by workqueue callbacks such as pvr_queue_fence_release_work, as observed in the reported kernel stack trace on Texas Instruments AM625 hardware. Successful exploitation may cause kernel panic, memory corruption, or elevation of privilege depending on heap state.

The fix removes the redundant drm_sched_entity_fini() call from the destruction path, retaining it only within the pvr_context_create() failure path where it is required. See the Linux Kernel Commit c88fdbf3 for the upstream patch.

Detection Methods for CVE-2026-68263

Indicators of Compromise

Kernel log entries containing refcount_t: underflow; use-after-free originating from refcount_warn_saturate+0xf4/0x144
Stack traces referencing drm_sched_entity_fini called from pvr_queue_destroy and pvr_context_destroy_queues
Warnings tied to the powervr-sched workqueue and pvr_queue_fence_release_work handler
Unexpected GPU driver crashes or hangs on systems using Imagination PowerVR hardware

Detection Strategies

Monitor dmesg and syslog for WARNING: lib/refcount.c:28 messages associated with the powervr and gpu_sched modules
Correlate kernel warnings with local processes performing frequent GPU context creation and destruction
Track loaded kernel module versions to identify hosts running vulnerable builds of the powervr driver

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized SIEM or data lake for pattern matching on refcount underflow signatures
Alert on repeated gpu_sched or powervr warnings from the same host, which may indicate exploitation attempts
Baseline normal GPU context churn rates and flag anomalous spikes from non-graphics workloads

How to Mitigate CVE-2026-68263

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below and reboot affected systems
Inventory hosts running the powervr driver, particularly TI AM625 and other Imagination GPU platforms
Restrict local access to DRM device nodes (/dev/dri/*) to trusted users and groups only

Patch Information

The issue is resolved upstream in the Linux kernel. Refer to the following stable commits: Linux Kernel Commit 4af24c27, Linux Kernel Commit 9be3f4bd, Linux Kernel Commit c1136d90, and Linux Kernel Commit c88fdbf3. Distribution vendors are expected to backport these fixes into supported stable kernel branches.

Workarounds

Unload the powervr kernel module on systems that do not require GPU acceleration
Tighten permissions on /dev/dri/renderD* and /dev/dri/card* to restrict which local accounts can open the device
Deploy Linux endpoint monitoring to detect abnormal kernel warnings and unauthorized local access to GPU device nodes

bash

# Restrict access to DRM device nodes to the video group
sudo chown root:video /dev/dri/renderD128 /dev/dri/card0
sudo chmod 0660 /dev/dri/renderD128 /dev/dri/card0

# Optionally blacklist the powervr module on non-GPU workloads
echo 'blacklist powervr' | sudo tee /etc/modprobe.d/blacklist-powervr.conf
sudo update-initramfs -u