CVE-2026-64148: Linux Kernel Privilege Escalation Flaw

CVE-2026-64148 Overview

CVE-2026-64148 is a Linux kernel vulnerability in the pds_core driver affecting the pdsc_devcmd_wait() function. The flaw involves incorrect error handling that causes the function to return stale success values from the completion register instead of propagating real error conditions. Two specific scenarios trigger the bug: firmware crashes where the wait loop breaks with running=false, and command timeouts where the error code is overwritten by pdsc_err_to_errno(status) reading stale status. Both cases prevent proper error propagation to pdsc_devcmd_locked(), which normally queues health_work for recovery.

Critical Impact
Missing error propagation in the pds_core device command path prevents recovery routines from executing, leading to availability loss on systems using AMD Pensando distributed services cards.

Affected Products

Linux kernel versions containing the pds_core driver prior to the fix commits
Systems using AMD Pensando distributed services card (DSC) hardware
Linux stable branches referenced in the kernel git commits

Discovery Timeline

2026-07-19 - CVE-2026-64148 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64148

Vulnerability Analysis

The vulnerability resides in the pdsc_devcmd_wait() function within the Linux kernel's pds_core driver. This function waits for device command completion and returns a status code that upper layers use to trigger recovery.

Two defects exist in the original error handling logic. First, when firmware crashes, the wait loop exits early with running=false. The condition if ((!done || timeout) && running) evaluates to false, bypassing the error handling block entirely. The function then returns a stale success value read from the completion register. Second, on command timeout, the local err variable is correctly set to -ETIMEDOUT, but is immediately overwritten by a call to pdsc_err_to_errno(status) that reads stale status data.

The fix reorders the checks to test !running first and return -ENXIO for firmware crashes. For timeouts, the patch returns -ETIMEDOUT immediately after cleanup, preventing the stale status overwrite.

Root Cause

The root cause is improper error handling ordering combined with reliance on hardware register values that become stale during fault conditions. The completion register is not authoritative when firmware has stopped executing or when the driver has already declared a timeout. Reading it in these states produces misleading success indicators.

Attack Vector

The CVSS vector indicates a network attack vector with high availability impact and no impact on confidentiality or integrity. Exploitation requires conditions that trigger firmware crashes or command timeouts on the affected device. When these conditions occur, the missing error propagation prevents the health_work recovery routine from executing, extending the availability outage.

The vulnerability affects a kernel driver, so exploitation vectors depend on how the affected pds_core device is exposed and what triggers can cause firmware faults or command stalls.

Detection Methods for CVE-2026-64148

Indicators of Compromise

Repeated pds_core device command failures without corresponding health recovery events in kernel logs
Firmware crash indicators from the AMD Pensando DSC without subsequent driver recovery attempts
Kernel messages showing successful command completion followed by device unresponsiveness
Absence of expected health_work queue activity after firmware faults

Detection Strategies

Audit installed kernel versions across Linux hosts and identify those running vulnerable pds_core driver builds
Correlate dmesg output showing pds_core command activity with device health state transitions
Monitor for anomalies in device command latency that could indicate silent failures
Compare running kernel commit hashes against the fix commits 0e46b66, 10ae318, 3231aff, 560d559, and 784dd2b

Monitoring Recommendations

Instrument kernel log collection to capture pds_core driver messages centrally for correlation
Alert on unexpected device resets, firmware crashes, or command timeout events on hosts with Pensando hardware
Track kernel package versions across the fleet and flag hosts running unpatched builds

How to Mitigate CVE-2026-64148

Immediate Actions Required

Identify all Linux systems using the pds_core driver, particularly those with AMD Pensando DSC hardware
Apply the upstream kernel fix commits or update to a distribution kernel that incorporates them
Validate that health_work recovery routines execute correctly after simulated fault conditions in test environments
Prioritize patching on systems where device availability is business-critical

Patch Information

The fix was committed to the Linux kernel across multiple stable branches. Reference the following commits: Kernel Git Commit 0e46b66, Kernel Git Commit 10ae318, Kernel Git Commit 3231aff, Kernel Git Commit 560d559, and Kernel Git Commit 784dd2b. The patches restructure pdsc_devcmd_wait() to check !running first and return -ENXIO, and to return -ETIMEDOUT immediately after timeout cleanup.

Workarounds

No official workaround exists — the fix requires the kernel patch
Where patching is delayed, implement out-of-band monitoring for device health on hosts with Pensando hardware
Restrict conditions that could trigger firmware faults, such as workload patterns known to stress the DSC

bash

# Verify running kernel version and pds_core module status
uname -r
modinfo pds_core | grep -E 'version|filename'
dmesg | grep -i pds_core