# CVE-2026-68319: pds_core: fix deadlock between reset thread and remove

> A race condition in the pds_core driver causes a deadlock during device removal, leading to a local denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 17 Aug 2026
- **Also known as:** BELL-CVE-2026-68319, DEBIAN-CVE-2026-68319, GHSA-mf5x-243c-mv86, UBUNTU-CVE-2026-68319

## What is CVE-2026-68319?

CVE-2026-68319 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix deadlock between reset thread and remove

pci_reset_function() acquires device_lock before performing the reset.
pdsc_remove() is called by the PCI core with device_lock already held.
If pdsc_pci_reset_thread() is running when pdsc_remove() is called,
destroy_workqueue() will block waiting for the work to complete, while
the work is blocked waiting for device_lock - deadlock.

Use pci_try_reset_function() which uses pci_dev_trylock() internally.
This acquires both the device lock and the PCI config access lock
without blocking - if either lock is contended, it returns -EAGAIN
immediately. This avoids the deadlock while also ensuring proper
config space access serialization during the reset.

The pci_dev_get/put calls are also removed as they were unnecessary -
the driver-owned workqueue is destroyed in pdsc_remove(), guaranteeing
the work completes before remove returns. The PCI core holds its
reference to pci_dev throughout the entire unbind sequence.

## Which versions are affected by CVE-2026-68319?


## How do I fix CVE-2026-68319?

Apply the vendor's patch.

## Is CVE-2026-68319 being exploited?

There is no known exploitation of CVE-2026-68319 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68319 and fix it if it is affected.

What it is: CVE-2026-68319 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-68319 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68319/ (Markdown: https://insights.sbomify.com/CVE-2026-68319/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68319
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68319
- OSV: https://osv.dev/vulnerability/CVE-2026-68319

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68319/
Summaries are generated and may contain mistakes; the official description above is the record.