CVE-2026-64148

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A Linux system bug can make the computer ignore certain device problems and keep going when it should recover, which might cause crashes or unreliable operation.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Other
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

pdsc_devcmd_wait returns stale success from completion register instead of -ENXIO on firmware crash or -ETIMEDOUT on timeout, bypassing error paths and preventing propagation to pdsc_devcmd_locked health_work recovery.

Why it matters to the business

Undetected device command failures in Linux kernel environments can cause prolonged instability, failed recovery, or denial of service without administrator visibility.

How an attack unfolds

An attacker induces firmware crash or command timeout conditions during device operations; the flawed error checks allow stale success to be returned, suppressing recovery and enabling continued faulty operation or crashes.

How to fix it

Apply a kernel update containing the pdsc_devcmd_wait error handling fixes (check !running before status checks and return -ETIMEDOUT immediately on timeout).

How to confirm the fix worked

Inspect kernel source or git history for the pdsc_devcmd_wait changes that prioritize running check and immediate timeout return; test device command paths under simulated crash/timeout.

Typical attack path

Issue device commands via pds_core driver
Trigger firmware crash or timeout condition
Observe bypassed error handling and stale success return
Prevent health_work recovery from executing

How to detect it

Review kernel logs and dmesg for device command timeouts, firmware crash indicators, or unexpected health_work queuing without prior error status.

What your security team should do

Prioritize kernel upgrades for systems using pds_core
Enable kernel logging of device command errors and health_work events
Monitor EPSS trend and re-evaluate if exploit maturity increases

The record

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.

Affected packages

Ecosystem	Package	Introduced	Fixed