Skip to main content

Linux Kernel CVE-2026-64148

| EUVDEUVD-2026-45833 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-19 Linux GHSA-xjpg-r9jg-hhhf
Denial Of Service Linux
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Only reachable on hosts with Pensando hardware and requires a firmware crash/timeout race, so AV:L and AC:H; local privileged context implies PR:L; impact is availability-only (A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:43 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix error handling in pdsc_devcmd_wait

Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error:

  1. FW crash: If firmware stops running, the wait loop breaks early with

running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.

  1. Timeout: If a command times out, err is set to -ETIMEDOUT but then

overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.

Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.

AnalysisAI

Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.

Technical ContextAI

The affected component is pds_core, the Linux kernel driver for AMD/Pensando Distributed Services Cards, which communicates with card firmware via a device-command (devcmd) register interface. pdsc_devcmd_wait() polls a completion/status register and evaluates the guard condition 'if ((!done || timeout) && running)'. Two logic defects exist: on a firmware crash the loop exits with running=false, making the guard false so error handling is skipped and a stale 'success' status is returned; and on timeout, err is correctly set to -ETIMEDOUT but is then overwritten by pdsc_err_to_errno(status) reading a stale register value. The root cause is an error-handling / incorrect-return-value class defect (no CWE was assigned in the source data; conceptually akin to CWE-393 Return of Wrong Status Code / CWE-755 Improper Handling of Exceptional Conditions). CPE data identifies only the generic cpe:2.3:a:linux:linux, so exact affected build must be derived from the kernel version ranges.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.142, 6.12.92, 6.18.34, 7.0.11, or mainline 7.1 - via your distribution's kernel updates, and reboot to load the corrected pds_core module. The fix is available as upstream stable commits (e.g. https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14 and the sibling commits linked in the advisory) for backporting. If immediate patching is not possible on a system using AMD Pensando cards, there is no clean feature-level workaround because the defect is in the driver's core command-wait path; compensating options are limited to monitoring for firmware/devcmd errors and manually recovering (reloading the pds_core module or resetting the device) when the card stops responding, with the trade-off that recovery is manual rather than automatic. On systems without Pensando DSC hardware, the driver is not loaded and no action beyond routine patching is required.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64148 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy