CVE-2026-98020
Received Received - Intake

Race Condition in Linux Kernel PDS Core Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix cmd_regs access racing BAR unmap on reset pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path clear/iounmap cmd_regs without devcmd_lock, and pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after dropping and retaking the lock without re-checking. An FLR concurrent with a devlink flash can unmap cmd_regs under an in-flight devcmd, causing a NULL deref or a write to unmapped MMIO. Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in the download loop. Only the PF maps cmd_regs and runs devcmd, so skip the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do. A reset that completes entirely within the unlocked window is not a correctness problem for the image: the device clears its update session, so a resumed download is rejected, and it verifies the staged image before writing a flash slot, reporting PDS_RC_BAD_FW rather than activating it. pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The interrupt and start/stop readers of those are quiesced before the unmap by pdsc_fw_down(), which frees the interrupts and tears down the queues. The debugfs readers are not, since those files outlive a reset; that is pre-existing and out of scope here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98020
EUVD
EUVD-2026-86673

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition during device reset operations. The issue occurs when BAR (Base Address Register) unmapping and remapping happens concurrently with device command execution. Specifically, the cmd_regs memory region can be cleared or unmapped while a device command is still in progress, leading to NULL pointer dereferences or writes to unmapped memory-mapped I/O (MMIO) regions.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or unexpected behavior in systems using the affected Linux kernel component. It may lead to denial-of-service conditions or potential privilege escalation if exploited. Systems with devices using the pds_core driver are particularly at risk.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves the pds_core racing BAR unmap issue. Ensure the fix for cmd_regs access during reset is applied to prevent NULL dereference or MMIO write errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart