Executive brief
The Linux kernel's DRM driver for Imagination GPUs contains a logic error when processing paired geometry and fragment jobs. When the driver checks for available space to submit a fragment job, it incorrectly looks in the geometry job's command buffer instead of the fragment job's own buffer. This can cause the driver to attempt writing commands to a full buffer, resulting in kernel warnings and potential job timeouts that disrupt GPU workloads.
Technical details
The vulnerability exists in the drm/imagination driver's prepare_job() callback when handling paired geometry and fragment jobs submitted together. The callback incorrectly checks available space in the geometry job's CCCB (Command Control Circular Buffer) instead of the fragment job's CCCB when determining whether the fragment job can be submitted. This root cause is an inappropriate mismatch between the fragment job and geometry queue during space validation. An attacker with access to submit GPU workloads could trigger a condition where the driver writes commands to an exhausted buffer, bypassing space checks and causing kernel warnings in pvr_cccb_write_command_with_header(). The fix moves paired fragment job initialization to a function that correctly infers the fragment job's own queue, ensuring space checks operate on the correct buffer. A patch is available in the Linux kernel upstream.
Affected products
- Linux Linux kernel 7.0-rc2 and possibly other versions
Timeline
- 2026-08-12: disclosed