CVE-2026-64148 pds_core: fix error handling in pdsc_devcmd_wait
A flaw in the pds_core driver error handling allows stale status returns during firmware crashes or timeouts, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64148?
CVE-2026-64148 is a high-severity denial of service vulnerability in Linux kernel, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix error handling in pdsc_devcmd_wait
Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error:
1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.
2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.
Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.
Weakness: CWE-835
Which versions are affected by CVE-2026-64148?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64148?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64148 being exploited?
There is no known exploitation of CVE-2026-64148 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64148, DEBIAN-CVE-2026-64148, GHSA-xjpg-r9jg-hhhf, UBUNTU-CVE-2026-64148.