CVE-2026-68318
Estado: RecibidaSin puntuar—
In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix use-after-free on workqueue during remove
In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:
Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.
Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:
Detalles técnicos trazas, registros y código del informe original
1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error
path in pdsc_devcmd_locked() queues health_work.
2. A NotifyQ event can trigger the ISR and queue work before free_irq()
is called in pdsc_teardown().
- In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()
the queue's work and only then clear qcq->intx, so
pdsc_process_adminq()'s read of qcq->intx for interrupt-credit
return cannot race with the clear.
- Free adminqcq before notifyqcq: the shared adminq ISR is released
when adminqcq is freed, and the adminq work accesses notifyqcq, so
both must be stopped before notifyqcq is freed.CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-68318",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
"lessThan": "224214eb4182ff20a665b615a90b66017539dd75",
"versionType": "git"
},
{
"status": "affected",
"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
"lessThan": "9e0f80fac50ab95dd75537c8ecaf5051d01f19b5",
"versionType": "git"
},
{
"status": "affected",
"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
"lessThan": "ecc7a7d7569ec1d6a61e18372696b9de97635156",
"versionType": "git"
},
{
"status": "affected",
"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
"lessThan": "0ad134881508c36b65c1a8864f8bec53adbd3327",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/amd/pds_core/core.c",
"drivers/net/ethernet/amd/pds_core/main.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/amd/pds_core/core.c",
"drivers/net/ethernet/amd/pds_core/main.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-10T13:20:21.813",
"references": [
{
"url": "https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix use-after-free on workqueue during remove\n\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\nis called. This ordering allows two paths to queue work on the\ndestroyed workqueue:\n\n1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error\n path in pdsc_devcmd_locked() queues health_work.\n\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\n is called in pdsc_teardown().\n\nFix by moving destroy_workqueue() after pdsc_teardown() so the\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\nwork still pending.\n\nDraining the queued work also requires ordering the teardown so the\nresources that work touches are freed last:\n\n - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\n the queue's work and only then clear qcq->intx, so\n pdsc_process_adminq()'s read of qcq->intx for interrupt-credit\n return cannot race with the clear.\n\n - Free adminqcq before notifyqcq: the shared adminq ISR is released\n when adminqcq is freed, and the adminq work accesses notifyqcq, so\n both must be stopped before notifyqcq is freed."
}
],
"lastModified": "2026-08-17T05:18:34.727",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}