High 7.5Published Jul 19, 2026

CVE-2026-64148pds_core: fix error handling in pdsc_devcmd_wait

Updated under an hour ago (Oct 27, 2026, 9:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 45d76f492938cdc27ddadc16e1e75103f4cfbf56 before 3231aff8ab26111c54e630b1a200fc43a729dd14; 45d76f492938cdc27ddadc16e1e75103f4cfbf56 builds before 10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2; from 45d76f492938cdc27ddadc16e1e75103f4cfbf56 before 784dd2bdc622ed3cc6ef8e113aa1852e252de36f; from 45d76f492938cdc27ddadc16e1e75103f4cfbf56 before 560d559324169fe0583d54c475b5329550a86f71; 45d76f492938cdc27ddadc16e1e75103f4cfbf56 builds before 0e46b6635b03d29807f810c3b415c4755a3f958d	CNA record
linux linux_kernel linux:linux_kernel	from 6.4 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14	patch
https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2	patch
https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f	patch
https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71	patch
https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.