In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where… (CVE-2026-64148)
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64148 concerns improper error handling in the pds_core subsystem's pdsc_devcmd_wait() function. Two scenarios caused stale success statuses to be returned: (1) when firmware crashes and the wait loop exits early, error handling was bypassed due to an incorrect condition check, and (2) when a command times out, the timeout error was overwritten by a stale status read. The patch corrects these by checking the firmware running state first and returning appropriate error codes immediately, ensuring errors propagate to pdsc_devcmd_locked() which initiates recovery work.
Potential Impact
The vulnerability could cause the system to incorrectly interpret error conditions as success, potentially delaying or preventing recovery actions after firmware crashes or command timeouts in the pds_core component. This may affect system stability or reliability where this kernel component is used. There is no indication of known exploits in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to correct error handling in the pds_core pdsc_devcmd_wait function. Users should apply the official kernel updates that include this patch when available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where… (CVE-2026-64148)
Description
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64148 concerns improper error handling in the pds_core subsystem's pdsc_devcmd_wait() function. Two scenarios caused stale success statuses to be returned: (1) when firmware crashes and the wait loop exits early, error handling was bypassed due to an incorrect condition check, and (2) when a command times out, the timeout error was overwritten by a stale status read. The patch corrects these by checking the firmware running state first and returning appropriate error codes immediately, ensuring errors propagate to pdsc_devcmd_locked() which initiates recovery work.
Potential Impact
The vulnerability could cause the system to incorrectly interpret error conditions as success, potentially delaying or preventing recovery actions after firmware crashes or command timeouts in the pds_core component. This may affect system stability or reliability where this kernel component is used. There is no indication of known exploits in the wild.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to correct error handling in the pds_core pdsc_devcmd_wait function. Users should apply the official kernel updates that include this patch when available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xjpg-r9jg-hhhf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64148"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912a8a2
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:43:06 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.