CVE-2026-68318 (GCVE-0-2026-68318)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-17 05:03
VLAI
Title
pds_core: fix use-after-free on workqueue during remove
Summary
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix use-after-free on workqueue during remove In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work. 2. A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown(). Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending. Draining the queued work also requires ordering the teardown so the resources that work touches are freed last: - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear. - Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 01ba61b55b2041a39c54aefb3153c770dd59a0ef , < 224214eb4182ff20a665b615a90b66017539dd75 (git)
Affected: 01ba61b55b2041a39c54aefb3153c770dd59a0ef , < 9e0f80fac50ab95dd75537c8ecaf5051d01f19b5 (git)
Affected: 01ba61b55b2041a39c54aefb3153c770dd59a0ef , < ecc7a7d7569ec1d6a61e18372696b9de97635156 (git)
Affected: 01ba61b55b2041a39c54aefb3153c770dd59a0ef , < 0ad134881508c36b65c1a8864f8bec53adbd3327 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/core.c",
            "drivers/net/ethernet/amd/pds_core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "224214eb4182ff20a665b615a90b66017539dd75",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            },
            {
              "lessThan": "9e0f80fac50ab95dd75537c8ecaf5051d01f19b5",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            },
            {
              "lessThan": "ecc7a7d7569ec1d6a61e18372696b9de97635156",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            },
            {
              "lessThan": "0ad134881508c36b65c1a8864f8bec53adbd3327",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/core.c",
            "drivers/net/ethernet/amd/pds_core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix use-after-free on workqueue during remove\n\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\nis called. This ordering allows two paths to queue work on the\ndestroyed workqueue:\n\n1. If pdsc_teardown() -\u003e pdsc_devcmd_reset() times out, the error\n   path in pdsc_devcmd_locked() queues health_work.\n\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\n   is called in pdsc_teardown().\n\nFix by moving destroy_workqueue() after pdsc_teardown() so the\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\nwork still pending.\n\nDraining the queued work also requires ordering the teardown so the\nresources that work touches are freed last:\n\n  - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\n    the queue\u0027s work and only then clear qcq-\u003eintx, so\n    pdsc_process_adminq()\u0027s read of qcq-\u003eintx for interrupt-credit\n    return cannot race with the clear.\n\n  - Free adminqcq before notifyqcq: the shared adminq ISR is released\n    when adminqcq is freed, and the adminq work accesses notifyqcq, so\n    both must be stopped before notifyqcq is freed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:03:15.551Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327"
        }
      ],
      "title": "pds_core: fix use-after-free on workqueue during remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68318",
    "datePublished": "2026-08-10T12:02:53.197Z",
    "dateReserved": "2026-07-30T09:28:09.382Z",
    "dateUpdated": "2026-08-17T05:03:15.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68318",
      "date": "2026-08-20",
      "epss": "0.00168",
      "percentile": "0.06511"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68318\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:21.813\",\"lastModified\":\"2026-08-17T05:18:34.727\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npds_core: fix use-after-free on workqueue during remove\\n\\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\\nis called. This ordering allows two paths to queue work on the\\ndestroyed workqueue:\\n\\n1. If pdsc_teardown() -\u003e pdsc_devcmd_reset() times out, the error\\n   path in pdsc_devcmd_locked() queues health_work.\\n\\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\\n   is called in pdsc_teardown().\\n\\nFix by moving destroy_workqueue() after pdsc_teardown() so the\\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\\nwork still pending.\\n\\nDraining the queued work also requires ordering the teardown so the\\nresources that work touches are freed last:\\n\\n  - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\\n    the queue\u0027s work and only then clear qcq-\u003eintx, so\\n    pdsc_process_adminq()\u0027s read of qcq-\u003eintx for interrupt-credit\\n    return cannot race with the clear.\\n\\n  - Free adminqcq before notifyqcq: the shared adminq ISR is released\\n    when adminqcq is freed, and the adminq work accesses notifyqcq, so\\n    both must be stopped before notifyqcq is freed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/amd/pds_core/core.c\",\"drivers/net/ethernet/amd/pds_core/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"01ba61b55b2041a39c54aefb3153c770dd59a0ef\",\"lessThan\":\"224214eb4182ff20a665b615a90b66017539dd75\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01ba61b55b2041a39c54aefb3153c770dd59a0ef\",\"lessThan\":\"9e0f80fac50ab95dd75537c8ecaf5051d01f19b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01ba61b55b2041a39c54aefb3153c770dd59a0ef\",\"lessThan\":\"ecc7a7d7569ec1d6a61e18372696b9de97635156\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01ba61b55b2041a39c54aefb3153c770dd59a0ef\",\"lessThan\":\"0ad134881508c36b65c1a8864f8bec53adbd3327\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/amd/pds_core/core.c\",\"drivers/net/ethernet/amd/pds_core/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T17:30:31+00:00",
      "cve": "CVE-2026-68318",
      "id": "CVE-2026-68318",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: pds_core: fix use-after-free on workqueue during remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68318.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:48:06Z",
      "cve": "CVE-2026-68318",
      "id": "CVE-2026-68318",
      "initial_release_date": "2026-08-11T23:48:06Z",
      "product_status:known_affected": "129",
      "product_status:known_not_affected": "167",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68318",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68318.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.