CVE-2026-64148 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix error handling in pdsc_devcmd_wait
Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error:
1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.
2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.
Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the Linux kernel's pds_core subsystem, specifically within the pdsc_devcmd_wait function that handles device command synchronization. This flaw represents a critical error handling issue that can lead to incorrect status reporting and potential system instability. The vulnerability stems from improper conditional logic in the completion register evaluation process, where error states are not properly propagated back to calling functions. According to CWE-252, this manifests as an insufficient error handling mechanism that allows erroneous conditions to persist undetected within the system's operational flow.
The technical implementation flaw occurs in two distinct scenarios that both involve premature termination of command waiting loops without proper error state management. In the first case involving firmware crashes, when the firmware stops executing and the running flag is set to false, the conditional expression "if ((!done || timeout) && running)" evaluates to false due to the running parameter being false. This causes the error handling path to be bypassed entirely, resulting in stale success status being returned instead of appropriate error codes. The second scenario involves timeout conditions where the err variable is initially set to -ETIMEDOUT but gets overwritten by pdsc_err_to_errno(status) which reads from a stale completion register value. This demonstrates poor state management and improper resource cleanup procedures that violate established kernel programming practices.
The operational impact of this vulnerability extends beyond simple error reporting failures to potentially compromise system reliability and security posture. When firmware crashes occur without proper error propagation, the system may continue operating with stale device status information, leading to incorrect decision-making by higher-level subsystems. The timeout handling issue creates similar problems where command failures are not properly communicated to recovery mechanisms, potentially causing cascading failures in device management operations. According to ATT&CK framework's T1498 technique for Network Denial of Service, such improper error handling can contribute to service disruption scenarios that may be exploited by attackers to create persistent system instability. The affected component's role in device command processing means this vulnerability can impact various hardware subsystems that rely on proper completion status reporting.
The fix implements immediate return mechanisms for both error conditions before any stale data can be processed or overwritten, ensuring that error codes are properly propagated up the call stack. This correction addresses the root cause by checking for !running condition first and returning -ENXIO immediately when firmware crashes occur, while also ensuring -ETIMEDOUT is returned promptly after cleanup operations complete. The solution maintains proper resource management through appropriate cleanup before error propagation, aligning with kernel security best practices. The corrected function now properly signals pdsc_devcmd_locked() which can then queue health_work for appropriate recovery procedures, ensuring that system administrators and monitoring tools receive accurate information about device status changes. This remediation approach follows the principle of fail-fast error handling, where errors are detected and reported immediately rather than allowing stale data to propagate through the system. The fix ensures that all error conditions trigger proper recovery mechanisms as intended by the original system design, preventing potential security implications from undetected device failures or timeout conditions.