CVE-2026-98020

Received Received - Intake

Race Condition in Linux Kernel PDS Core Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix cmd_regs access racing BAR unmap on reset pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path clear/iounmap cmd_regs without devcmd_lock, and pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after dropping and retaking the lock without re-checking. An FLR concurrent with a devlink flash can unmap cmd_regs under an in-flight devcmd, causing a NULL deref or a write to unmapped MMIO. Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in the download loop. Only the PF maps cmd_regs and runs devcmd, so skip the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do. A reset that completes entirely within the unlocked window is not a correctness problem for the image: the device clears its update session, so a resumed download is rejected, and it verifies the staged image before writing a flash slot, reporting PDS_RC_BAD_FW rather than activating it. pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The interrupt and start/stop readers of those are quiesced before the unmap by pdsc_fw_down(), which frees the interrupts and tears down the queues. The debugfs readers are not, since those files outlive a reset; that is pre-existing and out of scope here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98020

EUVD

EUVD-2026-86673

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition during device reset operations. The issue occurs when BAR (Base Address Register) unmapping and remapping happens concurrently with device command execution. Specifically, the cmd_regs memory region can be cleared or unmapped while a device command is still in progress, leading to NULL pointer dereferences or writes to unmapped memory-mapped I/O (MMIO) regions.

Detection Guidance

This vulnerability is specific to the Linux kernel's pds_core driver and involves race conditions during device reset and BAR unmapping. Detection requires kernel-level inspection rather than network commands. Check kernel logs for errors related to pds_core or pdsc_reset_prepare/pdsc_reset_done functions. Look for NULL pointer dereferences or MMIO write errors during device resets or firmware updates.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or unexpected behavior in systems using the affected Linux kernel component. It may lead to denial-of-service conditions or potential privilege escalation if exploited. Systems with devices using the pds_core driver are particularly at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific Linux kernel driver issue involving memory access during device reset. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves the pds_core racing BAR unmap issue. Ensure the fix for cmd_regs access during reset is applied to prevent NULL dereference or MMIO write errors.

Hi! I’m here to help you understand CVE-2026-98020. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70