CVE-2026-97412: pds_core: quiesce DMA before freeing resources
In the Linux kernel, the following vulnerability has been resolved:
pdscore: quiesce DMA before freeing resources
pdscteardown() frees DMA buffers but does not disable bus mastering, leaving the device able to perform DMA after the buffers are freed. This can lead to use-after-free if the device writes to freed memory.
Add pciclearmaster() to pdscteardown() to disable bus mastering before freeing resources, ensuring all DMA is quiesced.
Add pcisetmaster() to pdscsetup() to re-enable bus mastering, which is needed for the firmware recovery path since pdscteardown() now disables it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Call pci_clear_master() in pdsc_teardown() before freeing DMA resources to quiesce DMA, and call pci_set_master() in pdsc_setup() to re-enable bus mastering for the firmware recovery path.
Linux kernel pds_core PCI bus mastering = disabled during pdsc_teardown() and enabled during pdsc_setup()
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel pds_core driver are exposed when the driver tears down device resources while the device can still perform DMA. The affected condition is specifically the teardown path that frees DMA buffers without first disabling PCI bus mastering.
What must occur for the use-after-free condition to arise?
The device must perform a DMA write after pdsc_teardown() has freed its DMA buffers. Because bus mastering remains enabled in the vulnerable behavior, the device can write to memory that has already been freed.
What does the fix change, and are there operational considerations?
The fix disables PCI bus mastering with pci_clear_master() before DMA resources are freed, quiescing DMA during teardown. It also re-enables bus mastering with pci_set_master() during setup because the firmware recovery path requires it.