CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait
In the Linux kernel, the following vulnerability has been resolved:
pdscore: fix error handling in pdscdevcmdwait
Fix two cases where pdscdevcmdwait() returns stale success from the completion register instead of an error:
1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.
2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdscerrtoerrno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.
Both errors now propagate to pdscdevcmdlocked() which queues healthwork for recovery.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64148?
The severity of CVE-2026-64148 is rated high with a CVSS score of 7.5.
What software is affected by CVE-2026-64148?
CVE-2026-64148 affects the Linux kernel.
How do I fix CVE-2026-64148?
To fix CVE-2026-64148, update to the latest version of the Linux kernel where the vulnerability has been patched.
What type of vulnerability is CVE-2026-64148?
CVE-2026-64148 is an error handling vulnerability in the pds_core component of the Linux kernel.
What impact does CVE-2026-64148 have on system security?
CVE-2026-64148 can lead to system crashes if firmware stops running due to stale success returns.