CVE-2026-68319 pds_core: fix deadlock between reset thread and remove
A race condition in the pds_core driver causes a deadlock during device removal, leading to a local denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68319?
CVE-2026-68319 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix deadlock between reset thread and remove
pci_reset_function() acquires device_lock before performing the reset. pdsc_remove() is called by the PCI core with device_lock already held. If pdsc_pci_reset_thread() is running when pdsc_remove() is called, destroy_workqueue() will block waiting for the work to complete, while the work is blocked waiting for device_lock - deadlock.
Use pci_try_reset_function() which uses pci_dev_trylock() internally. This acquires both the device lock and the PCI config access lock without blocking - if either lock is contended, it returns -EAGAIN immediately. This avoids the deadlock while also ensuring proper config space access serialization during the reset.
The pci_dev_get/put calls are also removed as they were unnecessary - the driver-owned workqueue is destroyed in pdsc_remove(), guaranteeing the work completes before remove returns. The PCI core holds its reference to pci_dev throughout the entire unbind sequence.
Which versions are affected by CVE-2026-68319?
How do I fix CVE-2026-68319?
Apply the vendor's patch.
Is CVE-2026-68319 being exploited?
There is no known exploitation of CVE-2026-68319 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68319, DEBIAN-CVE-2026-68319, GHSA-mf5x-243c-mv86, UBUNTU-CVE-2026-68319.