CVE-2026-93058: drm/msm: Only fini scheduler after successful init
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Only fini scheduler after successful init
msmringbuffernew() destroys a partially initialized ring through msmringbufferdestroy() when an allocation or scheduler setup step fails.
If drmschedinit() fails before it finishes initializing the scheduler, the failure path still calls drmschedfini(). That teardown path assumes the scheduler work items, lists, and workqueue state were initialized.
Track successful scheduler initialization and call drmschedfini() only after drmschedinit() returned 0.
This issue was found by a static analysis checker and confirmed by manual source review.
Patchwork: https://patchwork.freedesktop.org/patch/738905/
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 738905
Event History
Frequently Asked Questions
When can the unsafe teardown path be reached?
It can be reached when msm_ringbuffer_new() encounters an allocation failure or a scheduler setup failure, including drm_sched_init() failing before scheduler initialization completes.
What condition must be present for drm_sched_fini() to be safe?
drm_sched_fini() should be called only if drm_sched_init() returned 0. The fix tracks successful scheduler initialization so partially initialized scheduler state is not torn down.
How can teams determine whether their kernel includes the fix?
Check whether the relevant drm/msm ringbuffer cleanup path records successful scheduler initialization and gates drm_sched_fini() on that status. The provided stable-kernel references identify commits containing the resolution.