{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64148", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.037Z", "datePublished": "2026-07-19T15:40:38.816Z", "dateUpdated": "2026-07-20T13:43:47.299Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:43:47.299Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix error handling in pdsc_devcmd_wait\n\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n\n1. FW crash: If firmware stops running, the wait loop breaks early with\n running=false. The condition \"if ((!done || timeout) && running)\" is\n false, so error handling is bypassed and stale status is returned.\n Check !running first and return -ENXIO.\n\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\n overwritten by pdsc_err_to_errno(status) which reads stale status.\n Return -ETIMEDOUT immediately after cleaning up.\n\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/dev.c"], "versions": [{"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "3231aff8ab26111c54e630b1a200fc43a729dd14", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "784dd2bdc622ed3cc6ef8e113aa1852e252de36f", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "560d559324169fe0583d54c475b5329550a86f71", "status": "affected", "versionType": "git"}, {"version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56", "lessThan": "0e46b6635b03d29807f810c3b415c4755a3f958d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/dev.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.142", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14"}, {"url": "https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2"}, {"url": "https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f"}, {"url": "https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71"}, {"url": "https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d"}], "title": "pds_core: fix error handling in pdsc_devcmd_wait", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: pds_core: fix error handling in pdsc_devcmd_wait", "id": "2502519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502519"}, "csaw": false, "cwe": "CWE-393", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npds_core: fix error handling in pdsc_devcmd_wait\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n1. FW crash: If firmware stops running, the wait loop breaks early with\nrunning=false. The condition \"if ((!done || timeout) && running)\" is\nfalse, so error handling is bypassed and stale status is returned.\nCheck !running first and return -ENXIO.\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\noverwritten by pdsc_err_to_errno(status) which reads stale status.\nReturn -ETIMEDOUT immediately after cleaning up.\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery.", "A flaw was found in the Linux kernel's pds_core component. This vulnerability involves incorrect error handling within the pdsc_devcmd_wait function, which can cause the system to report a successful operation even when a firmware crash or command timeout has occurred. This misreporting can prevent proper error propagation and delay recovery actions, potentially leading to system instability or unexpected behavior. The issue stems from the function returning stale success status instead of an actual error, hindering the detection and resolution of underlying hardware or command processing problems."], "name": "CVE-2026-64148", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64148\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64148\nhttps://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-64148-ef5f@gregkh/T"], "threat_severity": "Moderate"}