CVE-2026-64147 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix debugfs_lookup dentry leak and error handling
debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery.
Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's pds_core module where improper handling of debugfs_lookup() function results in both resource leaks and system crashes. The issue stems from incorrect reference counting management when working with dentry objects in the debug filesystem. When debugfs_lookup() is invoked, it returns a dentry structure with an incremented reference count that must be explicitly released using dput() to prevent memory leaks. The current implementation fails to properly release these references, creating a persistent resource leak that accumulates with each firmware reset recovery operation.
The operational impact of this vulnerability extends beyond simple memory consumption to potential system instability and denial of service conditions. Every firmware reset event triggers the leak scenario, meaning that systems with frequent firmware resets or recovery operations will experience progressive memory degradation. Additionally, when the kernel is compiled without CONFIG_DEBUG_FS support, the debugfs_lookup() function returns an error pointer with ERR_PTR(-ENODEV) instead of NULL as expected by the existing code logic. This mismatch in return value handling causes the code to attempt calling dput() on what appears to be a valid pointer but is actually an invalid error pointer structure.
The technical flaw directly relates to CWE-404, which addresses improper resource management and memory leaks in software systems. The vulnerability demonstrates poor error handling practices where the code does not properly distinguish between valid return values and error conditions before attempting to process the returned data structure. This pattern of error handling failure also aligns with ATT&CK technique T1490, which involves system destruction through resource exhaustion and memory corruption attacks. The improper pointer validation leads to null pointer dereference scenarios that can result in kernel crashes and system instability.
Mitigation strategies should focus on implementing proper error checking before attempting to release references and ensuring that all returned dentry objects are properly managed regardless of the configuration state. The fix requires modifying the code to check for error pointers using IS_ERR() macro before processing the return value, and only calling dput() on valid dentry structures. Additionally, system administrators should consider monitoring kernel memory usage patterns for signs of resource leaks and ensure that firmware reset operations are properly logged and monitored to detect potential exploitation scenarios. The vulnerability underscores the importance of proper kernel module development practices and adherence to established security guidelines for reference counting and error handling mechanisms in kernel space code execution environments.