Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where… (CVE-2026-64148)

The Linux kernel vulnerability CVE-2026-64148 involves improper error handling in the pds_core subsystem's pdsc_devcmd_wait() function. Specifically, two cases were fixed where the function returned stale success statuses instead of errors: (1) when firmware crashes cause the wait loop to exit early without signaling an error, and (2) when command timeouts overwrite error codes with stale status values. These errors prevented correct error propagation to pdsc_devcmd_locked(), which is responsible for queuing recovery work. The fix ensures that errors like -ENXIO and -ETIMEDOUT are returned promptly, enabling proper recovery actions. The vulnerability affects many Linux kernel versions prior to 7.0.0-28.28 and others explicitly enumerated. The issue has been patched in official Linux kernel updates.

The vulnerability causes the Linux kernel to incorrectly report success in certain error conditions related to firmware crashes and command timeouts in the pds_core subsystem. This improper error handling can prevent the kernel from initiating recovery procedures, potentially leading to system instability or denial of service. The CVSS score of 7.5 indicates a medium severity impact, primarily affecting system availability (no confidentiality or integrity impact is indicated). There are no known exploits in the wild.

An official patch is available and should be applied by updating the Linux kernel to a fixed version at or beyond 7.0.0-28.28 or the specific patched versions listed in the advisory. After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully to ensure full remediation.