CVE-2026-68318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68318", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.382Z", "datePublished": "2026-08-10T12:02:53.197Z", "dateUpdated": "2026-10-21T12:43:51.063Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:43:51.063Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix use-after-free on workqueue during remove\n\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\nis called. This ordering allows two paths to queue work on the\ndestroyed workqueue:\n\n1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error\n path in pdsc_devcmd_locked() queues health_work.\n\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\n is called in pdsc_teardown().\n\nFix by moving destroy_workqueue() after pdsc_teardown() so the\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\nwork still pending.\n\nDraining the queued work also requires ordering the teardown so the\nresources that work touches are freed last:\n\n - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\n the queue's work and only then clear qcq->intx, so\n pdsc_process_adminq()'s read of qcq->intx for interrupt-credit\n return cannot race with the clear.\n\n - Free adminqcq before notifyqcq: the shared adminq ISR is released\n when adminqcq is freed, and the adminq work accesses notifyqcq, so\n both must be stopped before notifyqcq is freed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/main.c"], "versions": [{"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "bac237c2aedb8225bfd2317c1361bbfce1e419ca", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "224214eb4182ff20a665b615a90b66017539dd75", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "9e0f80fac50ab95dd75537c8ecaf5051d01f19b5", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "ecc7a7d7569ec1d6a61e18372696b9de97635156", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "0ad134881508c36b65c1a8864f8bec53adbd3327", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/main.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bac237c2aedb8225bfd2317c1361bbfce1e419ca"}, {"url": "https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75"}, {"url": "https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5"}, {"url": "https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156"}, {"url": "https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327"}], "title": "pds_core: fix use-after-free on workqueue during remove", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bac237c2aedb8225bfd2317c1361bbfce1e419ca", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "224214eb4182ff20a665b615a90b66017539dd75", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "9e0f80fac50ab95dd75537c8ecaf5051d01f19b5", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "ecc7a7d7569ec1d6a61e18372696b9de97635156", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "0ad134881508c36b65c1a8864f8bec53adbd3327", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix use-after-free on workqueue during remove\n\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\nis called. This ordering allows two paths to queue work on the\ndestroyed workqueue:\n\n1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error\n path in pdsc_devcmd_locked() queues health_work.\n\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\n is called in pdsc_teardown().\n\nFix by moving destroy_workqueue() after pdsc_teardown() so the\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\nwork still pending.\n\nDraining the queued work also requires ordering the teardown so the\nresources that work touches are freed last:\n\n - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\n the queue's work and only then clear qcq->intx, so\n pdsc_process_adminq()'s read of qcq->intx for interrupt-credit\n return cannot race with the clear.\n\n - Free adminqcq before notifyqcq: the shared adminq ISR is released\n when adminqcq is freed, and the adminq work accesses notifyqcq, so\n both must be stopped before notifyqcq is freed."}], "id": "CVE-2026-68318", "lastModified": "2026-10-21T13:19:27.973", "metrics": {}, "published": "2026-08-10T13:20:21.813", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bac237c2aedb8225bfd2317c1361bbfce1e419ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel: Use-after-free vulnerability in pds_core component", "id": "2513323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513323"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npds_core: fix use-after-free on workqueue during remove\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\nis called. This ordering allows two paths to queue work on the\ndestroyed workqueue:\n1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error\npath in pdsc_devcmd_locked() queues health_work.\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\nis called in pdsc_teardown().\nFix by moving destroy_workqueue() after pdsc_teardown() so the\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\nwork still pending.\nDraining the queued work also requires ordering the teardown so the\nresources that work touches are freed last:\n- In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\nthe queue's work and only then clear qcq->intx, so\npdsc_process_adminq()'s read of qcq->intx for interrupt-credit\nreturn cannot race with the clear.\n- Free adminqcq before notifyqcq: the shared adminq ISR is released\nwhen adminqcq is freed, and the adminq work accesses notifyqcq, so\nboth must be stopped before notifyqcq is freed.", "A flaw was found in the `pds_core` component of the Linux kernel. This use-after-free vulnerability occurs because the workqueue is destroyed prematurely during the `pdsc_remove()` operation, before `pdsc_teardown()` completes. This timing issue allows for work to be queued on an already destroyed workqueue, which can lead to system instability or potentially other impacts. The flaw can be triggered by specific error paths or NotifyQ events during device removal."], "name": "CVE-2026-68318", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:02:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68318\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68318\nhttps://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327\nhttps://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75\nhttps://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5\nhttps://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[01ba61b55b2041a39c54aefb3153c770dd59a0ef,224214eb4182ff20a665b615a90b66017539dd75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[01ba61b55b2041a39c54aefb3153c770dd59a0ef,9e0f80fac50ab95dd75537c8ecaf5051d01f19b5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[01ba61b55b2041a39c54aefb3153c770dd59a0ef,ecc7a7d7569ec1d6a61e18372696b9de97635156)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[01ba61b55b2041a39c54aefb3153c770dd59a0ef,0ad134881508c36b65c1a8864f8bec53adbd3327)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:15:04.691817+00:00", "updated": "2026-08-13T04:15:02.918850+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}