Cloudanix VulnDB

CVE-2026-68318

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug in the Linux kernel can let code keep running after memory has been freed during hardware removal, risking crashes or security issues on affected servers.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free caused by destroying a workqueue before teardown completes, allowing queued work from error paths or NotifyQ ISRs to reference freed structures, combined with races in interrupt and queue resource freeing.

Why it matters to the business

Kernel instability or crashes on systems using the affected driver during device removal or error handling, potentially leading to downtime or local privilege escalation on servers with the hardware.

How an attack unfolds

An attacker with local access triggers device removal or error paths in pdsc_remove that race the workqueue lifetime, queuing work after destruction or racing resource frees to achieve use-after-free.

How to fix it

Update the Linux kernel to a version that reorders destroy_workqueue after pdsc_teardown and adds proper cancel_work_sync before clearing interrupt state.

How to confirm the fix worked

Confirm the kernel source contains the corrected ordering of destroy_workqueue relative to pdsc_teardown and the added cancel_work_sync calls in pdsc_qcq_free.

Typical attack path

  1. Obtain local access on a system with the vulnerable pds_core driver loaded
  2. Trigger pdsc_remove via device unplug, driver unload, or error condition
  3. Force a devcmd timeout or NotifyQ event to queue work on the soon-to-be-destroyed workqueue
  4. Exploit the resulting use-after-free during work execution or interrupt credit handling

How to detect it

Review kernel logs for workqueue use-after-free warnings, oops involving pdsc_* functions, or crashes during driver unload; correlate with device removal events.

What your security team should do

  • Apply the upstream fix as soon as a patched kernel is available for the distribution
  • Monitor for kernel oops or workqueue warnings on systems exposing the driver
  • Limit unprivileged local access on hosts using the affected hardware until patched

The record

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix use-after-free on workqueue during remove In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work. 2. A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown(). Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending. Draining the queued work also requires ordering the teardown so the resources that work touches are freed last: - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear. - Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Affected packages

Ecosystem Package Introduced Fixed