All vulnerabilities
CVE-2026-98020

Linux: pds_core: fix cmd_regs access racing BAR unmap on reset

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9Also 2cc697565fd19b5ba2d100cdd4a20dd6d263abc2, 09f831bfe39de5b8026fefb3d106b5cc93272170 and 3 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9LinuxCVE List
  • 2cc697565fd19b5ba2d100cdd4a20dd6d263abc2LinuxCVE List
  • 09f831bfe39de5b8026fefb3d106b5cc93272170LinuxCVE List
  • 7980325b2f71e3f65c1323c39792e2455da6fab6LinuxCVE List
  • 6.6.158LinuxCVE List
  • 6.8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix cmd_regs access racing BAR unmap on reset

pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path clear/iounmap cmd_regs without devcmd_lock, and pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after dropping and retaking the lock without re-checking. An FLR concurrent with a devlink flash can unmap cmd_regs under an in-flight devcmd, causing a NULL deref or a write to unmapped MMIO.

Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in the download loop. Only the PF maps cmd_regs and runs devcmd, so skip the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do.

A reset that completes entirely within the unlocked window is not a correctness problem for the image: the device clears its update session, so a resumed download is rejected, and it verifies the staged image before writing a flash slot, reporting PDS_RC_BAD_FW rather than activating it.

pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The interrupt and start/stop readers of those are quiesced before the unmap by pdsc_fw_down(), which frees the interrupts and tears down the queues. The debugfs readers are not, since those files outlive a reset; that is pre-existing and out of scope here.

Text from CVE List

Affected versions 15

  • Linuxaffected: f6ec6ac9432941ec85a2221c91b1ecfc85680d89 before 0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9CVE List
  • Linuxaffected: e96094c1d11cce4deb5da3c0500d49041ab845b8 before 2cc697565fd19b5ba2d100cdd4a20dd6d263abc2CVE List
  • Linuxaffected: e96094c1d11cce4deb5da3c0500d49041ab845b8 before fa31bd14c5042c6315bb2182c963f03ca6e79ca4CVE List
  • Linuxaffected: e96094c1d11cce4deb5da3c0500d49041ab845b8 before 09f831bfe39de5b8026fefb3d106b5cc93272170CVE List
  • Linuxaffected: e96094c1d11cce4deb5da3c0500d49041ab845b8 before 7980325b2f71e3f65c1323c39792e2455da6fab6CVE List
  • Linuxaffected: 692488941283d72362274620b9abd28109fc459fCVE List
  • Linuxaffected: 6.6.16 before 6.6.158CVE List
  • Linuxaffected: 6.7.4 before 6.8CVE List
  • Linuxaffected: 6.8CVE List
  • Linuxunaffected: all versions before 6.8CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5