The Linux kernel vulnerability CVE-2026-64147 involves improper handling of the debugfs_lookup() function in the pds_core component. Specifically, the function returns a dentry with an elevated reference count that must be released with dput(), but the vulnerable code discarded the dentry without releasing it, causing a reference leak on every firmware reset recovery. Furthermore, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV) instead of NULL, and the existing error checking incorrectly calls dput() on these error pointers, which can cause kernel crashes. This issue has been resolved in the Linux kernel.

The vulnerability causes a reference count leak in the kernel during firmware reset recovery, which could lead to resource exhaustion over time. Additionally, incorrect error handling may cause kernel crashes when debugfs is disabled, potentially impacting system stability.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to resolve the reference leak and error handling issues. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance and apply updates accordingly.