{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68319 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68319 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-68319 and fix it if it is affected.\n\nWhat it is: CVE-2026-68319 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-68319 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68319/ (Markdown: https://insights.sbomify.com/CVE-2026-68319/index.md)","id":"CVE-2026-68319","markdown":"https://insights.sbomify.com/CVE-2026-68319/index.md","name":"CVE-2026-68319","record":{"aliases":["BELL-CVE-2026-68319","DEBIAN-CVE-2026-68319","GHSA-mf5x-243c-mv86","UBUNTU-CVE-2026-68319"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A race condition in the pds_core driver causes a deadlock during device removal, leading to a local denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix deadlock between reset thread and remove\n\npci_reset_function() acquires device_lock before performing the reset.\npdsc_remove() is called by the PCI core with device_lock already held.\nIf pdsc_pci_reset_thread() is running when pdsc_remove() is called,\ndestroy_workqueue() will block waiting for the work to complete, while\nthe work is blocked waiting for device_lock - deadlock.\n\nUse pci_try_reset_function() which uses pci_dev_trylock() internally.\nThis acquires both the device lock and the PCI config access lock\nwithout blocking - if either lock is contended, it returns -EAGAIN\nimmediately. This avoids the deadlock while also ensuring proper\nconfig space access serialization during the reset.\n\nThe pci_dev_get/put calls are also removed as they were unnecessary -\nthe driver-owned workqueue is destroyed in pdsc_remove(), guaranteeing\nthe work completes before remove returns. The PCI core holds its\nreference to pci_dev throughout the entire unbind sequence.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"pds_core: fix deadlock between reset thread and remove","id":"CVE-2026-68319","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid","id":"CVE-2026-68320"},"packages":[],"prev":{"headline":"pds_core: fix use-after-free on workqueue during remove","id":"CVE-2026-68318"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A race condition in the pds_core driver causes a deadlock during device removal, leading to a local denial of service.","url":"https://insights.sbomify.com/CVE-2026-68319/"}