CVE-2026-64148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64148", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.037Z", "datePublished": "2026-07-19T15:40:38.816Z", "dateUpdated": "2026-08-05T12:39:43.750Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:43.750Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix error handling in pdsc_devcmd_wait\n\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n\n1. FW crash: If firmware stops running, the wait loop breaks early with\n running=false. The condition \"if ((!done || timeout) && running)\" is\n false, so error handling is bypassed and stale status is returned.\n Check !running first and return -ENXIO.\n\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\n overwritten by pdsc_err_to_errno(status) which reads stale status.\n Return -ETIMEDOUT immediately after cleaning up.\n\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is in the AMD/Pensando pds_core host driver for a network DPU/NIC whose firmware processes remote traffic; a remote attacker can crash or hang firmware via crafted packets, which drives kernel recovery through pdsc_devcmd_locked() during pdsc_fw_up/pdsc_setup.\nAC:L - Once the device is reachable, an attacker can reliably induce the triggering conditions (firmware crash or devcmd timeout) by sending concurrent or malformed network traffic to stress the DPU firmware, without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation does not require host credentials; an unauthenticated remote attacker who can send traffic to the Pensando DSC interface can cause firmware failure that reaches pdsc_devcmd_wait() during automatic driver recovery, independent of devlink or root-only management paths.\nUI:N - No victim interaction is required beyond normal network connectivity to the affected DPU-backed host; recovery is triggered automatically by firmware failure and the driver's health/recovery workqueue path.\nS:U - The flaw affects host kernel driver state and device recovery within the same security authority; it does not cross a VM, container, or IOMMU boundary to impact a separate security domain.\nC:N - The bug is a logic error returning stale MMIO completion status rather than a memory-safety flaw; it does not expose arbitrary kernel memory, only misinterprets bounded device register contents from prior commands.\nI:N - There is no kernel memory corruption or arbitrary write primitive; the worst case is proceeding with stale device-command completion data, which affects driver/device recovery state rather than modifying protected host data.\nA:H - Masking firmware crash or timeout as success prevents immediate health_work recovery, can leave the driver believing a failed INIT/reset succeeded, and can cause prolonged or repeated loss of DPU/network availability on internet-facing cloud servers until manual intervention or repeated recovery cycles."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/dev.c"], "versions": [{"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "3231aff8ab26111c54e630b1a200fc43a729dd14", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "784dd2bdc622ed3cc6ef8e113aa1852e252de36f", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "560d559324169fe0583d54c475b5329550a86f71", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "0e46b6635b03d29807f810c3b415c4755a3f958d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/dev.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14"}, {"url": "https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2"}, {"url": "https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f"}, {"url": "https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71"}, {"url": "https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d"}], "title": "pds_core: fix error handling in pdsc_devcmd_wait", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3231aff8ab26111c54e630b1a200fc43a729dd14", "status": "affected", "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "versionType": "git"}, {"lessThan": "10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2", "status": "affected", "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "versionType": "git"}, {"lessThan": "784dd2bdc622ed3cc6ef8e113aa1852e252de36f", "status": "affected", "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "versionType": "git"}, {"lessThan": "560d559324169fe0583d54c475b5329550a86f71", "status": "affected", "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "versionType": "git"}, {"lessThan": "0e46b6635b03d29807f810c3b415c4755a3f958d", "status": "affected", "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.142", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.92", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "65A69F97-C925-4335-9AFA-AC101723FB38", "versionEndExcluding": "6.6.142", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix error handling in pdsc_devcmd_wait\n\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n\n1. FW crash: If firmware stops running, the wait loop breaks early with\n running=false. The condition \"if ((!done || timeout) && running)\" is\n false, so error handling is bypassed and stale status is returned.\n Check !running first and return -ENXIO.\n\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\n overwritten by pdsc_err_to_errno(status) which reads stale status.\n Return -ETIMEDOUT immediately after cleaning up.\n\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery."}], "id": "CVE-2026-64148", "lastModified": "2026-08-17T17:23:36.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:56.753", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: pds_core: fix error handling in pdsc_devcmd_wait", "id": "2502519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502519"}, "csaw": false, "cwe": "CWE-393", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npds_core: fix error handling in pdsc_devcmd_wait\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n1. FW crash: If firmware stops running, the wait loop breaks early with\nrunning=false. The condition \"if ((!done || timeout) && running)\" is\nfalse, so error handling is bypassed and stale status is returned.\nCheck !running first and return -ENXIO.\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\noverwritten by pdsc_err_to_errno(status) which reads stale status.\nReturn -ETIMEDOUT immediately after cleaning up.\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery.", "A flaw was found in the Linux kernel's pds_core component. This vulnerability involves incorrect error handling within the pdsc_devcmd_wait function, which can cause the system to report a successful operation even when a firmware crash or command timeout has occurred. This misreporting can prevent proper error propagation and delay recovery actions, potentially leading to system instability or unexpected behavior. The issue stems from the function returning stale success status instead of an actual error, hindering the detection and resolution of underlying hardware or command processing problems."], "name": "CVE-2026-64148", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64148\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64148\nhttps://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-64148-ef5f@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[45d76f492938cdc27ddadc16e1e75103f4cfbf56,3231aff8ab26111c54e630b1a200fc43a729dd14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[45d76f492938cdc27ddadc16e1e75103f4cfbf56,10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[45d76f492938cdc27ddadc16e1e75103f4cfbf56,784dd2bdc622ed3cc6ef8e113aa1852e252de36f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[45d76f492938cdc27ddadc16e1e75103f4cfbf56,560d559324169fe0583d54c475b5329550a86f71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[45d76f492938cdc27ddadc16e1e75103f4cfbf56,0e46b6635b03d29807f810c3b415c4755a3f958d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.142,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.92,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T11:15:05.701496+00:00", "updated": "2026-08-17T21:00:14.188608+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}