CVE-2026-64147: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64147 Overview

CVE-2026-64147 is a Linux kernel vulnerability in the pds_core driver. The flaw involves incorrect handling of the debugfs_lookup() return value, resulting in a dentry reference count leak on every firmware reset recovery. A secondary defect causes a potential crash when CONFIG_DEBUG_FS is disabled, because debugfs_lookup() returns ERR_PTR(-ENODEV) instead of NULL, and the existing check calls dput() on an invalid pointer. Upstream maintainers have committed fixes across multiple stable kernel branches.

Critical Impact
Repeated firmware reset recovery operations leak kernel dentry references, and kernels compiled without debugfs can crash when the pds_core driver attempts cleanup.

Affected Products

Linux kernel pds_core driver (AMD Pensando DSC networking core)
Kernel builds with and without CONFIG_DEBUG_FS enabled
Multiple stable kernel branches receiving backports (see referenced commits)

Discovery Timeline

2026-07-19 - CVE-2026-64147 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64147

Vulnerability Analysis

The pds_core driver calls debugfs_lookup() during firmware reset recovery to locate a debugfs entry. The function returns a dentry with an elevated reference count, and the caller must release it with dput(). The affected code discards the returned dentry without calling dput(), producing a reference leak that accumulates over each firmware reset cycle. Long-running systems that experience repeated firmware resets exhaust dentry references and pin debugfs objects in memory.

The second defect concerns kernels built without CONFIG_DEBUG_FS. In that configuration, debugfs_lookup() returns ERR_PTR(-ENODEV) rather than NULL. The existing null check treats the error pointer as a valid dentry, then passes it to dput(). Dereferencing an error-encoded pointer inside dput() corrupts kernel state and can crash the system.

Root Cause

The root cause is improper handling of the debugfs_lookup() API contract [CWE-401 Memory Leak, CWE-476 NULL Pointer Dereference class]. The driver code neither released the elevated reference nor validated the return value with IS_ERR() before calling dput(). Both conditions are triggered during the firmware reset recovery path in pds_core.

Attack Vector

Exploitation requires the ability to trigger firmware reset recovery on a system running the affected pds_core driver. This is not a remote network attack vector. The impact is limited to local denial of service through resource exhaustion or a kernel crash on debugfs-disabled builds. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability is described in the upstream Linux kernel commits. See the Linux Kernel Commit dc416e32 and related backport commits referenced in the NVD entry for the exact code change.

Detection Methods for CVE-2026-64147

Indicators of Compromise

Growth in dentry cache slab objects (dentry in /proc/slabinfo) correlating with firmware reset events on systems using AMD Pensando cards
Kernel oops or panic messages referencing dput or pds_core on kernels built without CONFIG_DEBUG_FS
Repeated entries in dmesg indicating firmware reset recovery in the pds_core driver

Detection Strategies

Inventory Linux hosts running the pds_core driver by checking lsmod | grep pds_core and correlate kernel versions against fixed commits
Monitor kernel logs for pds_core firmware reset events and inspect for accompanying reference counting warnings
Track dentry cache growth over time on affected hosts to identify slow resource exhaustion patterns

Monitoring Recommendations

Alert on unexpected kernel panics on hosts with AMD Pensando distributed services cards
Baseline slab allocation metrics via slabtop or node exporter and alert on sustained upward drift
Forward dmesg and journalctl -k output to a centralized logging platform for correlation of firmware reset frequency and kernel warnings

How to Mitigate CVE-2026-64147

Immediate Actions Required

Identify all Linux hosts loading the pds_core module and record their kernel versions
Apply the upstream stable kernel updates that include the fix commits referenced by the NVD entry
Prioritize hosts that experience frequent firmware reset events, as the leak grows with each reset

Patch Information

The fix is committed to the mainline Linux kernel and backported to multiple stable branches. Refer to the following upstream commits: Linux Kernel Commit 26e19622, Linux Kernel Commit 60ef1675, Linux Kernel Commit 91d13e92, Linux Kernel Commit d7f4dd4c, and Linux Kernel Commit dc416e32. Consume the fix through your Linux distribution's kernel update channel once the backport is included in a released package.

Workarounds

Where feasible, avoid triggering firmware reset recovery on the pds_core device until the patched kernel is deployed
Unload the pds_core module on systems that do not require the AMD Pensando distributed services card functionality
On systems compiled without CONFIG_DEBUG_FS, defer use of pds_core-managed devices until an updated kernel is available to prevent the potential crash path

bash

# Check current kernel version and pds_core module status
uname -r
lsmod | grep pds_core

# Review recent firmware reset activity in kernel logs
journalctl -k | grep -i pds_core

# Inspect dentry cache pressure
grep '^dentry' /proc/slabinfo