CVE-2024-26623

What it actually does

Race condition in pds_core adminq handling allows concurrent access paths (ISR workqueue and pdsc_adminq_post) to dereference a NULL pointer after the queue is destroyed during PCIe reset or fw_down/fw_up cycles.

Why it matters to the business

Systems using the affected driver can experience unexpected kernel crashes or denial of service during device resets or firmware state changes, increasing downtime risk for storage or network hardware relying on this kernel module.

How an attack unfolds

An attacker with local access or the ability to induce device resets triggers the race by performing adminq operations via pdsc_adminq_post or the ISR path immediately after the adminq is destroyed but before state checks prevent further use, leading to NULL dereference.

How to fix it

Update the Linux kernel to a version containing commit 22cd6046eb2148b18990257505834dd45c672a1b which adds PDSC_S_FW_DEAD state checks and adminq_refcnt reference counting; apply the fix from the stable GIT tree.

How to confirm the fix worked

Verify the running kernel contains commit 22cd6046eb2148b18990257505834dd45c672a1b or later equivalent; confirm adminq_refcnt initialization and PDSC_S_FW_DEAD handling in pds_core source; test device reset cycles under load.

Typical attack path

1. Trigger or wait for PCIe reset or fw_down/fw_up cycle that destroys the adminq
2. Issue concurrent adminq access via pdsc_adminq_post or adminq ISR work
3. Bypass missing state checks to dereference freed or NULL adminq structure
4. Cause kernel NULL pointer dereference and system crash

How to detect it

Review kernel logs for NULL pointer dereference oops mentioning pdsc, adminq, pdsc_work_thread, or pdsc_adminq_post around device reset or firmware events; correlate with PCIe AER or fw_down/fw_up cycle messages.

• pdsc_adminq_isr
• pdsc_work_thread
• pdsc_process_adminq
• PDSC_S_FW_DEAD
• adminq_refcnt

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately on affected systems
• Monitor for kernel oops involving pdsc_adminq during maintenance windows
• Restrict unprivileged local access until patched to reduce race trigger surface