CVE-2026-93058: drm/msm: Only fini scheduler after successful init

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Only fini scheduler after successful init

msmringbuffernew() destroys a partially initialized ring through msmringbufferdestroy() when an allocation or scheduler setup step fails.

If drmschedinit() fails before it finishes initializing the scheduler, the failure path still calls drmschedfini(). That teardown path assumes the scheduler work items, lists, and workqueue state were initialized.

Track successful scheduler initialization and call drmschedfini() only after drmschedinit() returned 0.

This issue was found by a static analysis checker and confirmed by manual source review.

Patchwork: https://patchwork.freedesktop.org/patch/738905/

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch 738905

Event History

Sep 17, 2026
CVE Published
via MITRE·04:10 PM
Data Sourced
via MITRE·04:10 PM
Description

Frequently Asked Questions

1

When can the unsafe teardown path be reached?

It can be reached when msm_ringbuffer_new() encounters an allocation failure or a scheduler setup failure, including drm_sched_init() failing before scheduler initialization completes.

2

What condition must be present for drm_sched_fini() to be safe?

drm_sched_fini() should be called only if drm_sched_init() returned 0. The fix tracks successful scheduler initialization so partially initialized scheduler state is not torn down.

3

How can teams determine whether their kernel includes the fix?

Check whether the relevant drm/msm ringbuffer cleanup path records successful scheduler initialization and gates drm_sched_fini() on that status. The provided stable-kernel references identify commits containing the resolution.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203