CVE-2026-93058

drm/msm: Only fini scheduler after successful init

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Only fini scheduler after successful init

msm_ringbuffer_new() destroys a partially initialized ring through msm_ringbuffer_destroy() when an allocation or scheduler setup step fails.

If drm_sched_init() fails before it finishes initializing the scheduler, the failure path still calls drm_sched_fini(). That teardown path assumes the scheduler work items, lists, and workqueue state were initialized.

Track successful scheduler initialization and call drm_sched_fini() only after drm_sched_init() returned 0.

This issue was found by a static analysis checker and confirmed by manual source review.

Patchwork: https://patchwork.freedesktop.org/patch/738905/

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before 20ea0ae8e90702acca83467207db4c9bd8c8bd03Affected 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before bd2a5a876904eaf688a093cd73986abc3571f26bAffected 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before aafc9258efeec98fcb7e3998356b4b25bf1ad159Affected 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before d43e1bbfd43458b9242806eec77ea3b032134bafAffected 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before 09b360eb6ce345996a30fad8c86e9df80f41cd7eAffected 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before e2332abed2a4d3caa59052095dc16e4ce44791eaAffected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before 20ea0ae8e90702acca83467207db4c9bd8c8bd03Affected
1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before bd2a5a876904eaf688a093cd73986abc3571f26bAffected
1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before aafc9258efeec98fcb7e3998356b4b25bf1ad159Affected
1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before d43e1bbfd43458b9242806eec77ea3b032134bafAffected
1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before 09b360eb6ce345996a30fad8c86e9df80f41cd7eAffected
1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 to before e2332abed2a4d3caa59052095dc16e4ce44791eaAffected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.