CVE-2026-98020 (GCVE-0-2026-98020)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-19 09:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: pds_core: fix cmd_regs access racing BAR unmap on reset pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path clear/iounmap cmd_regs without devcmd_lock, and pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after dropping and retaking the lock without re-checking. An FLR concurrent with a devlink flash can unmap cmd_regs under an in-flight devcmd, causing a NULL deref or a write to unmapped MMIO. Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in the download loop. Only the PF maps cmd_regs and runs devcmd, so skip the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do. A reset that completes entirely within the unlocked window is not a correctness problem for the image: the device clears its update session, so a resumed download is rejected, and it verifies the staged image before writing a flash slot, reporting PDS_RC_BAD_FW rather than activating it. pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The interrupt and start/stop readers of those are quiesced before the unmap by pdsc_fw_down(), which frees the interrupts and tears down the queues. The debugfs readers are not, since those files outlive a reset; that is pre-existing and out of scope here.
References
Impacted products
Vendor Product Version
Linux Linux Version: f6ec6ac9432941ec85a2221c91b1ecfc85680d89
Version: e96094c1d11cce4deb5da3c0500d49041ab845b8
Version: e96094c1d11cce4deb5da3c0500d49041ab845b8
Version: e96094c1d11cce4deb5da3c0500d49041ab845b8
Version: e96094c1d11cce4deb5da3c0500d49041ab845b8
Version: 692488941283d72362274620b9abd28109fc459f
Version: 6.6.16   ≤
Version: 6.7.4   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/fw.c",
            "drivers/net/ethernet/amd/pds_core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9",
              "status": "affected",
              "version": "f6ec6ac9432941ec85a2221c91b1ecfc85680d89",
              "versionType": "git"
            },
            {
              "lessThan": "2cc697565fd19b5ba2d100cdd4a20dd6d263abc2",
              "status": "affected",
              "version": "e96094c1d11cce4deb5da3c0500d49041ab845b8",
              "versionType": "git"
            },
            {
              "lessThan": "fa31bd14c5042c6315bb2182c963f03ca6e79ca4",
              "status": "affected",
              "version": "e96094c1d11cce4deb5da3c0500d49041ab845b8",
              "versionType": "git"
            },
            {
              "lessThan": "09f831bfe39de5b8026fefb3d106b5cc93272170",
              "status": "affected",
              "version": "e96094c1d11cce4deb5da3c0500d49041ab845b8",
              "versionType": "git"
            },
            {
              "lessThan": "7980325b2f71e3f65c1323c39792e2455da6fab6",
              "status": "affected",
              "version": "e96094c1d11cce4deb5da3c0500d49041ab845b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "692488941283d72362274620b9abd28109fc459f",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "6.6.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/fw.c",
            "drivers/net/ethernet/amd/pds_core/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix cmd_regs access racing BAR unmap on reset\n\npdsc_reset_prepare() and pdsc_reset_done()\u0027s pdsc_map_bars() error path\nclear/iounmap cmd_regs without devcmd_lock, and\npdsc_legacy_firmware_update()\u0027s download loop derefs cmd_regs after\ndropping and retaking the lock without re-checking. An FLR concurrent\nwith a devlink flash can unmap cmd_regs under an in-flight devcmd,\ncausing a NULL deref or a write to unmapped MMIO.\n\nTake devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in\nthe download loop. Only the PF maps cmd_regs and runs devcmd, so skip\nthe unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do.\n\nA reset that completes entirely within the unlocked window is not a\ncorrectness problem for the image: the device clears its update session,\nso a resumed download is rejected, and it verifies the staged image\nbefore writing a flash slot, reporting PDS_RC_BAD_FW rather than\nactivating it.\n\npdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The\ninterrupt and start/stop readers of those are quiesced before the unmap\nby pdsc_fw_down(), which frees the interrupts and tears down the queues.\nThe debugfs readers are not, since those files outlive a reset; that is\npre-existing and out of scope here."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:12:25.476Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa31bd14c5042c6315bb2182c963f03ca6e79ca4"
        },
        {
          "url": "https://git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170"
        },
        {
          "url": "https://git.kernel.org/stable/c/7980325b2f71e3f65c1323c39792e2455da6fab6"
        }
      ],
      "title": "pds_core: fix cmd_regs access racing BAR unmap on reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98020",
    "datePublished": "2026-09-25T10:23:40.900Z",
    "dateReserved": "2026-09-25T10:19:56.069Z",
    "dateUpdated": "2026-10-19T09:12:25.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.