CVE-2026-64148

Analyzed Analyzed - Analysis Complete

Kernel Error Handling Flaw in PDS Core Driver

Publication date: 2026-07-19

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-17

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64148

EUVD

EUVD-2026-45833

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.4 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect error handling in the pdsc_devcmd_wait function. It fails to properly detect firmware crashes or command timeouts, returning stale success status instead of actual errors like -ENXIO or -ETIMEDOUT. This allows the system to continue operating with invalid state.

Detection Guidance

This vulnerability is specific to the Linux kernel's pds_core driver and involves error handling in pdsc_devcmd_wait(). Detection requires checking kernel logs for firmware crashes or command timeouts related to this driver. Monitor dmesg or journalctl for errors like -ENXIO or -ETIMEDOUT in pds_core operations.

Impact Analysis

This could lead to system instability or data corruption if firmware crashes or commands fail silently. The kernel may not trigger recovery processes, potentially causing hangs or incorrect device behavior without clear error indication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver error handling issue that could lead to system instability or improper error propagation, but no evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a custom kernel, apply the upstream fix for pdsc_devcmd_wait() error handling. Monitor kernel logs for firmware crashes or timeouts in pds_core operations.

Hi! I’m here to help you understand CVE-2026-64148. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70