CVE-2026-97412

Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pds_core: quiesce DMA before freeing resources pdsc_teardown() frees DMA buffers but does not disable bus mastering, leaving the device able to perform DMA after the buffers are freed. This can lead to use-after-free if the device writes to freed memory. Add pci_clear_master() to pdsc_teardown() to disable bus mastering before freeing resources, ensuring all DMA is quiesced. Add pci_set_master() to pdsc_setup() to re-enable bus mastering, which is needed for the firmware recovery path since pdsc_teardown() now disables it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97412

EUVD

EUVD-2026-86025

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	45d76f492938cdc27ddadc16e1e75103f4cfbf56
Linux	Linux	45d76f492938cdc27ddadc16e1e75103f4cfbf56
Linux	Linux	45d76f492938cdc27ddadc16e1e75103f4cfbf56
Linux	Linux	6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of DMA (Direct Memory Access) resources in the pds_core driver. The function pdsc_teardown() frees DMA buffers without disabling bus mastering, allowing the device to continue performing DMA operations after the buffers are freed. This can lead to a use-after-free scenario where the device writes to memory that has already been freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's pds_core driver and requires checking if the affected driver is loaded and if the system is running a vulnerable kernel version. Use commands like 'lsmod | grep pds_core' to check if the driver is loaded and 'uname -a' to verify the kernel version. If the driver is loaded and the kernel is vulnerable, patching is required.

Impact Analysis

This vulnerability could allow an attacker with access to the affected system to trigger a use-after-free condition, potentially leading to system crashes, data corruption, or privilege escalation. It may also enable arbitrary code execution if exploited successfully.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory access through DMA operations after resources are freed. Use-after-free scenarios may lead to data leaks or corruption, violating data integrity and confidentiality requirements in these regulations.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the pds_core driver if it is not essential to system operations. Monitor vendor advisories for updates and patches.

Hi! I’m here to help you understand CVE-2026-97412. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70