CVE-2026-64148
Received Received - Intake

Kernel Error Handling Flaw in PDS Core Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64148
EUVD
EUVD-2026-45833

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect error handling in the pdsc_devcmd_wait function. It fails to properly detect firmware crashes or command timeouts, returning stale success status instead of actual errors like -ENXIO or -ETIMEDOUT. This allows the system to continue operating with invalid state.

Detection Guidance

This vulnerability is specific to the Linux kernel's pds_core driver and involves error handling in pdsc_devcmd_wait(). Detection requires checking kernel logs for firmware crashes or command timeouts related to this driver. Monitor dmesg or journalctl for errors like -ENXIO or -ETIMEDOUT in pds_core operations.

Impact Analysis

This could lead to system instability or data corruption if firmware crashes or commands fail silently. The kernel may not trigger recovery processes, potentially causing hangs or incorrect device behavior without clear error indication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver error handling issue that could lead to system instability or improper error propagation, but no evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a custom kernel, apply the upstream fix for pdsc_devcmd_wait() error handling. Monitor kernel logs for firmware crashes or timeouts in pds_core operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart