{"id":"CVE-2026-68318","summary":"pds_core: fix use-after-free on workqueue during remove","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix use-after-free on workqueue during remove\n\nIn pdsc_remove(), the workqueue is destroyed before pdsc_teardown()\nis called. This ordering allows two paths to queue work on the\ndestroyed workqueue:\n\n1. If pdsc_teardown() -\u003e pdsc_devcmd_reset() times out, the error\n   path in pdsc_devcmd_locked() queues health_work.\n\n2. A NotifyQ event can trigger the ISR and queue work before free_irq()\n   is called in pdsc_teardown().\n\nFix by moving destroy_workqueue() after pdsc_teardown() so the\nworkqueue outlives every queuer; destroy_workqueue() then flushes any\nwork still pending.\n\nDraining the queued work also requires ordering the teardown so the\nresources that work touches are freed last:\n\n  - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()\n    the queue's work and only then clear qcq-\u003eintx, so\n    pdsc_process_adminq()'s read of qcq-\u003eintx for interrupt-credit\n    return cannot race with the clear.\n\n  - Free adminqcq before notifyqcq: the shared adminq ISR is released\n    when adminqcq is freed, and the adminq work accesses notifyqcq, so\n    both must be stopped before notifyqcq is freed.","modified":"2026-08-18T03:30:56.155257795Z","published":"2026-08-10T12:02:53.197Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68318.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327"},{"type":"WEB","url":"https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68318.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68318"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"01ba61b55b2041a39c54aefb3153c770dd59a0ef"},{"fixed":"224214eb4182ff20a665b615a90b66017539dd75"},{"fixed":"9e0f80fac50ab95dd75537c8ecaf5051d01f19b5"},{"fixed":"ecc7a7d7569ec1d6a61e18372696b9de97635156"},{"fixed":"0ad134881508c36b65c1a8864f8bec53adbd3327"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68318.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68318.json"}}],"schema_version":"1.9.0"}