CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling
In the Linux kernel, the following vulnerability has been resolved:
pdscore: fix debugfslookup dentry leak and error handling
debugfslookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery.
Additionally, when CONFIGDEBUGFS is disabled, debugfslookup() returns ERRPTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In pds_core, handle debugfs_lookup() returning ERR_PTR(-ENODEV) rather than NULL, avoid calling dput() on an invalid pointer, and call dput() on the returned valid dentry to prevent the reference leak during firmware reset recovery.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64147?
CVE-2026-64147 has a risk score of 27, indicating a significant vulnerability in the Linux Kernel.
How do I fix CVE-2026-64147?
To fix CVE-2026-64147, update your Linux Kernel to the latest version that includes the patch for this vulnerability.
What does CVE-2026-64147 affect?
CVE-2026-64147 affects the Linux Kernel, specifically the handling of dentry in the debugfs_lookup function.
What is debugfs_lookup in CVE-2026-64147?
In CVE-2026-64147, debugfs_lookup is a function that returns a dentry with an elevated reference count, requiring correct management to avoid resource leaks.
What are the consequences of not addressing CVE-2026-64147?
Failure to address CVE-2026-64147 could lead to resource leaks and potential instability in the Linux Kernel.