CVE-2026-64147
Received Received - Intake

debugfs dentry leak in Linux kernel pds_core

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix debugfs_lookup dentry leak and error handling debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64147
EUVD
EUVD-2026-45832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference leak and improper error handling in the pds_core driver. The debugfs_lookup function returns a dentry with an elevated reference count that must be released with dput(). The code fails to call dput(), causing a reference leak during firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup returns ERR_PTR(-ENODEV) instead of NULL, leading to a crash if dput() is called on an invalid pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's pds_core driver and debugfs handling. Detection requires checking for kernel logs or system crashes related to debugfs operations or firmware reset recovery. No direct network detection commands are applicable. Review kernel logs for debugfs-related errors or crashes using dmesg or journalctl.

Impact Analysis

This vulnerability can cause system instability by leaking kernel memory references, potentially leading to resource exhaustion or crashes during firmware reset operations. Systems relying on the pds_core driver may experience unexpected behavior or failures.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel reference leak in debugfs handling. It may indirectly impact compliance if the leak causes system instability or crashes during firmware recovery, potentially affecting data integrity or availability.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. If immediate patching is not possible, disable the pds_core driver if not required or restrict access to debugfs functionality to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart