CVE-2026-68317
NoneCVSS
—
EPSS
0.2%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A timing flaw in Linux kernel code for handling virtual network devices can cause crashes or wasted memory when multiple management actions happen at once.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in pds_core auxiliary device slot management allows concurrent add paths to register duplicate devices without slot checks (memory leak) and concurrent del paths to pass NULL checks outside config_lock (NULL pointer dereference).
Why it matters to the business
Affected Linux systems risk kernel crashes or resource exhaustion during VF management, leading to denial of service for networking functions and potential service disruption in virtualized environments.
How an attack unfolds
An attacker with local privileges triggers simultaneous pdsc_reset_done and devlink enable_vnet/disable_vnet operations on the same VF slot; the unsynchronized slot access either leaks an auxiliary device object or dereferences NULL after the first delete clears the slot.
How to fix it
Apply a kernel update that moves both slot check and update operations under config_lock in the pds_core add and del paths; rebuild and reboot with the patched kernel.
How to confirm the fix worked
Inspect the patched pds_core source to confirm slot checks occur inside config_lock for both add and del; perform stress testing with concurrent reset and devlink operations to verify absence of leaks or crashes.
Typical attack path
- Obtain local access or elevated privileges on a system running the vulnerable kernel
- Initiate concurrent VF reset and devlink vnet operations targeting the same slot
- Trigger the race window to cause either object leak or NULL dereference crash
How to detect it
Search kernel logs and dmesg for pds_core NULL pointer dereference oops or auxiliary device registration warnings; correlate with devlink and VF reset activity in audit or system logs.
What your security team should do
- Prioritize kernel upgrades for systems exposing pds_core VF management
- Limit unprivileged access to devlink and VF configuration interfaces
- Monitor kernel logs for pds_core-related oops and auxiliary device anomalies until patched
The record
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix auxiliary device add/del races Two paths add or delete the same slot (pf->vfs[vf_id].padev): a VF's pdsc_reset_done() and the PF's devlink enable_vnet/disable_vnet handler. They serialize on config_lock, but neither guards the slot under it correctly. add() registers and stores a new auxiliary device without first checking the slot, so a second add of an already-populated slot leaks the first device. del() makes that check outside config_lock, so two concurrent dels can both pass it; the first clears the slot, and the second dereferences a NULL pointer. Check and update the slot under config_lock in both paths.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|