CVE-2026-68317
Received Received - Intake

Race Condition in Linux Kernel pds_core Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix auxiliary device add/del races Two paths add or delete the same slot (pf->vfs[vf_id].padev): a VF's pdsc_reset_done() and the PF's devlink enable_vnet/disable_vnet handler. They serialize on config_lock, but neither guards the slot under it correctly. add() registers and stores a new auxiliary device without first checking the slot, so a second add of an already-populated slot leaks the first device. del() makes that check outside config_lock, so two concurrent dels can both pass it; the first clears the slot, and the second dereferences a NULL pointer. Check and update the slot under config_lock in both paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68317
EUVD
EUVD-2026-55418

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves race conditions in auxiliary device management. Two code paths, one handling virtual function resets and another handling device link enable/disable, can concurrently access the same slot without proper synchronization. This leads to device leaks or NULL pointer dereferences due to incorrect slot checks.

Detection Guidance

This vulnerability is specific to the Linux kernel's pds_core driver and involves race conditions in auxiliary device management. Detection requires checking kernel logs for related errors or kernel crashes during device hotplug operations. Monitor for messages like NULL pointer dereferences or device registration failures in dmesg or system logs.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior due to NULL pointer dereferences or resource leaks. It may affect systems using the pds_core driver, potentially leading to service disruptions or data corruption.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-68317. If immediate patching is not possible, disable the pds_core driver or avoid using virtual function hotplug operations until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart