CVE-2026-64148

pds_core: fix error handling in pdsc_devcmd_wait

State: Published
Severity: 7.5 High
Published: Jul 19, 2026
Updated: Aug 5, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix error handling in pdsc_devcmd_wait

Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error:

1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.

2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.

Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 3231aff8ab26111c54e630b1a200fc43a729dd14Affected 45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2Affected 45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 784dd2bdc622ed3cc6ef8e113aa1852e252de36fAffected 45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 560d559324169fe0583d54c475b5329550a86f71Affected 45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 0e46b6635b03d29807f810c3b415c4755a3f958dAffected
LinuxLinux	6.4Affected before 6.4Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 3231aff8ab26111c54e630b1a200fc43a729dd14Affected
45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2Affected
45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 784dd2bdc622ed3cc6ef8e113aa1852e252de36fAffected
45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 560d559324169fe0583d54c475b5329550a86f71Affected
45d76f492938cdc27ddadc16e1e75103f4cfbf56 to before 0e46b6635b03d29807f810c3b415c4755a3f958dAffected

LinuxLinux

6.4Affected
before 6.4Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.