Cloudanix VulnDB

CVE-2026-64147

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can leak memory or crash the system during hardware recovery operations, leading to unexpected downtime.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes a dentry reference leak on every firmware reset recovery because debugfs_lookup() results are not released with dput(); additionally, when debugfs is disabled the code mishandles ERR_PTR(-ENODEV) and may invoke dput() on an invalid pointer, leading to a crash.

Why it matters to the business

Repeated firmware resets can exhaust kernel memory or trigger kernel panics, causing denial of service on affected Linux systems and requiring reboots that disrupt workloads.

How an attack unfolds

A local attacker with the ability to trigger pds_core firmware reset recovery paths repeatedly invokes the buggy code path; each reset leaks a dentry reference and, under disabled debugfs configurations, may dereference an invalid error pointer, resulting in a kernel crash.

How to fix it

Update the Linux kernel to a version containing the fix that properly calls dput() on debugfs_lookup() results and correctly checks for both NULL and error pointers before any dput() call.

How to confirm the fix worked

Confirm the patched source contains the dput() call after debugfs_lookup() and the IS_ERR() check before any dput(); boot a test system with CONFIG_DEBUG_FS disabled and exercise firmware reset paths without observing a crash.

Typical attack path

  1. Obtain local access on a system using the pds_core driver
  2. Trigger firmware reset recovery (via device events or crafted operations)
  3. Repeat the reset to accumulate dentry leaks or trigger the invalid dput() path
  4. Observe memory pressure or kernel panic

How to detect it

Review kernel logs for repeated dentry reference warnings or crashes involving debugfs_lookup and dput during pds_core reset events; inspect systems for CONFIG_DEBUG_FS=n configurations that may surface the invalid pointer path.

What your security team should do

  • Prioritize kernel updates on systems exposing the pds_core driver
  • Monitor for kernel oops or dentry-related warnings in dmesg after firmware resets
  • Consider disabling unnecessary debugfs mounts in production kernels until patched

The record

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix debugfs_lookup dentry leak and error handling debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities