FKIE_CVE-2026-97412

Vulnerability from fkie_nvd - Published: 2026-09-24 17:17 - Updated: 2026-09-25 13:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: pds_core: quiesce DMA before freeing resources pdsc_teardown() frees DMA buffers but does not disable bus mastering, leaving the device able to perform DMA after the buffers are freed. This can lead to use-after-free if the device writes to freed memory. Add pci_clear_master() to pdsc_teardown() to disable bus mastering before freeing resources, ensuring all DMA is quiesced. Add pci_set_master() to pdsc_setup() to re-enable bus mastering, which is needed for the firmware recovery path since pdsc_teardown() now disables it.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6443f4f20bdae726fe01cf5946fba9742a0ffda6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9eee6b90bee3df496ed9094d9e76d5e478d72d0a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cc8beb70e70fc90e54efdbc1128cf7de799e6be4
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc8beb70e70fc90e54efdbc1128cf7de799e6be4",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            },
            {
              "lessThan": "9eee6b90bee3df496ed9094d9e76d5e478d72d0a",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            },
            {
              "lessThan": "6443f4f20bdae726fe01cf5946fba9742a0ffda6",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: quiesce DMA before freeing resources\n\npdsc_teardown() frees DMA buffers but does not disable bus mastering,\nleaving the device able to perform DMA after the buffers are freed.\nThis can lead to use-after-free if the device writes to freed memory.\n\nAdd pci_clear_master() to pdsc_teardown() to disable bus mastering\nbefore freeing resources, ensuring all DMA is quiesced.\n\nAdd pci_set_master() to pdsc_setup() to re-enable bus mastering,\nwhich is needed for the firmware recovery path since pdsc_teardown()\nnow disables it."
    }
  ],
  "id": "CVE-2026-97412",
  "lastModified": "2026-09-25T13:17:24.740",
  "metrics": {},
  "published": "2026-09-24T17:17:18.847",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6443f4f20bdae726fe01cf5946fba9742a0ffda6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9eee6b90bee3df496ed9094d9e76d5e478d72d0a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cc8beb70e70fc90e54efdbc1128cf7de799e6be4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.